PT-2026-30818 · Dolibarr+1 · Dolibarr Erp/Crm+1

Jiva · Published 2026-04-07 · Updated 2026-04-19 · CVE-2026-22666

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions prior to 23.0.2

Description An authenticated remote code execution issue exists in the dol eval standard() function. The system fails to apply forbidden string checks when operating in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval(). The root cause is that the $forbiddenphpstrings blocklist is only enforced in blacklist mode, while the whitelist regex is blind to PHP dynamic callable syntax.

Recommendations Update to version 23.0.2 or later.

Exploit

Fix

RCE

Eval Injection

Code Injection

Weakness Enumeration

CWE-95

CWE-94

Related Identifiers

CVE-2026-22666

Affected Products

Dolibarr Erp/Crm

Dolibarr

References · 14

• 🔥 https://jivasecurity.com/writeups/dolibarr-remote-code-execution-cve-2026-22666 · Exploit
• https://github.com/Dolibarr/dolibarr/commit/6f425521b3e6f9f27eca05228e02093dbaa40dea · Patch
• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-vmvw-qq8w-wqhg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22666 · Security Note
• https://ubuntu.com/security/CVE-2026-22666 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22666 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22666 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2 · Note
• https://twitter.com/Dinosn/status/2043689628901703786 · Twitter Post
• https://twitter.com/CVEnew/status/2045972451751039417 · Twitter Post
• https://twitter.com/VivekIntel/status/2043743978907120058 · Twitter Post
• https://vulncheck.com/advisories/dolibarr-erp-crm-authenticated-rce-via-dol-eval-standard · Note
• https://twitter.com/_r_netsec/status/2043686412684578839 · Twitter Post
• https://twitter.com/secharvesterx/status/2043705866621264134 · Twitter Post