Vulnerability · Published Apr 7, 2026 · Assigned by VulnCheck

CVE-2026-22666Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()

High 7.2

In plain English

A high-severity security flaw in Dolibarr ERP/CRM from Dolibarr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.8% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)15.8%top 3.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().

Affected products (as reported)

Vendor	Product	Versions
Dolibarr	Dolibarr ERP/CRM	0 – before 23.0.2

Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://jivasecurity.com/writeups/dolibarr-remote-code-execution-cve-2026-22666 technical-description, exploit
https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-vmvw-qq8w-wqhg vendor-advisory
https://github.com/Dolibarr/dolibarr/commit/6f425521b3e6f9f27eca05228e02093dbaa40dea patch
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2 release-notes
https://www.vulncheck.com/advisories/dolibarr-erp-crm-authenticated-rce-via-dol-eval-standard third-party-advisory