CVE-2026-22666: Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dolevalstandard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarr ERP/CRMto a version that resolves this vulnerability.Fixed in 23.0.2 - Compensating control
For authenticated access to any functionality that could reach dol_eval_standard(), restrict administrator-privileged actions and limit who/what can use computed extrafields or other evaluation paths (e.g., enforce strong access control so only trusted admin users can submit/modify them).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22666?
CVE-2026-22666 is considered a critical vulnerability due to its potential for authenticated remote code execution.
How do I fix CVE-2026-22666?
To fix CVE-2026-22666, upgrade Dolibarr ERP/CRM to version 23.0.2 or later.
What causes CVE-2026-22666 in Dolibarr ERP/CRM?
CVE-2026-22666 is caused by a failure in the dol_eval_standard() function to properly apply forbidden string checks in whitelist mode.
Who is affected by CVE-2026-22666?
Users of Dolibarr ERP/CRM versions prior to 23.0.2 are affected by CVE-2026-22666.
What type of vulnerability is CVE-2026-22666?
CVE-2026-22666 is classified as an authenticated remote code execution vulnerability.