PT-2026-30818 · Dolibarr · Dolibarr Erp/Crm

Jiva · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-22666

Mitre

CVSS v3.1

7.2

High

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol eval standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().

Exploit

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-22666

Affected Products

Dolibarr Erp/Crm

References · 6

• 🔥 https://jivasecurity.com/writeups/dolibarr-remote-code-execution-cve-2026-22666 · Exploit
• https://github.com/Dolibarr/dolibarr/commit/6f425521b3e6f9f27eca05228e02093dbaa40dea · Patch
• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-vmvw-qq8w-wqhg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22666 · Security Note
• https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2 · Note
• https://vulncheck.com/advisories/dolibarr-erp-crm-authenticated-rce-via-dol-eval-standard · Note