Priority reviewHigh

CVE-2026-22666

Dolibarr Dolibarr ERP/CRM, dolibarr erp/crm

Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().

CVSS: 8.6
EPSS: 15.5%
CISA KEV: Not listed
Published: 2026.04.07

PRIORITY ASSESSMENT

Priority review

FIRST EPSS indicates an elevated probability of exploitation.

Known exploitationNot established by KEV

Exploit probability15.5%

Technical severityCVSS 8.6

Vulnerability overview

Affected product and versions

Product: Dolibarr Dolibarr ERP/CRM, dolibarr erp/crm
Affected versions: < 23.0.2
Fixed versions: 23.0.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Dolibarr Dolibarr ERP/CRM, dolibarr erp/crm and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE: CWE-94, CWE-95