PT-2026-39008 · Dolibarr · Dolibarr

Published 2026-05-08 · Updated 2026-05-12 · CVE-2025-67486

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dolibarr versions 22.0.2 and earlier

Description An authenticated remote code execution issue exists in the user extrafields functionality of this ERP and CRM software. User-controlled input from the "computed value" field is passed to the PHP eval() function without adequate sanitization, which allows authenticated administrators to execute arbitrary PHP code on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2025-67486

Affected Products

Dolibarr

References · 5

• 🔥 https://medium.com/@abduxalilovjavohir/dolibarr-erp-authenticated-remote-code-execution-via-eval-injection-in-user-extrafields-dfc305d0118e · Exploit
• https://github.com/Dolibarr/dolibarr/blob/22.0.2/htdocs/core/lib/functions.lib.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-67486 · Security Note
• https://t.me/cveNotify/163292 · Telegram Post
• https://twitter.com/CVEnew/status/2052767655741034714 · Twitter Post