Read the docs
TI-2026-18201 Aliases CVE-2026-22666GHSA-m6qg-6w6h-v59x

Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()

Priority MEDIUM 55CWE-95Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-95.

Summary

Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.15787 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Dolibarr ERP/CRM (Dolibarr): 23.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DolibarrDolibarr ERP/CRMbefore 23.0.223.0.2Patch availableCNA
  • Dolibarr ERP/CRM VendorDolibarr Affected before 23.0.2 Fixed in 23.0.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dolibarr:dolibarr_erp\/crm:*:*:*:*:*:*:*:*before 23.0.2VulnerableDolibarr
  • cpe:2.3:a:dolibarr:dolibarr_erp\/crm:*:*:*:*:*:*:*:* Versions before 23.0.2 Vulnerable ·Dolibarr

Remediation

  • Fix · CNA Dolibarr ERP/CRM (Dolibarr) Fixed in 23.0.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22666
  2. 2026-10-03 Alias added: GHSA-m6qg-6w6h-v59x

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2022-21049 Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. CVSS 3.1CRITICAL 9.8
  • TI-2022-03742 SQL Injection in dolibarr/dolibarr CVSS 3.1CRITICAL 9.8
  • TI-2023-14191 Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an… CVSS 3.1HIGH 8.8
  • TI-2018-15582 Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php CVSS 4.0CRITICAL 9.3
  • TI-2019-15505 Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid CVSS 4.0HIGH 8.8
  • TI-2026-18933 Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration CVSS 4.0CRITICAL 9.4
See all 110 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences