https://reddit.com/r/cybersecurity/comments/1skb3o3/cve202622666_dolibarr_2300_dol_eval_whitelist/: CVE-2026-22666: Dolibarr 23.0.0 dol_eval() whitelist bypass -> RCE (full write-up + PoC)
Published Apr 13, 2026
·Updated
Affected Software
1 affected component
dolibarr Dolibarr=23.0.0
Frequently Asked Questions
1
What is the severity of CVE-2026-22666?
CVE-2026-22666 has been classified as critical due to its ability to allow remote command execution.
2
How do I fix CVE-2026-22666?
To mitigate CVE-2026-22666, update Dolibarr to the latest version where the vulnerability has been patched.
3
What versions of Dolibarr are affected by CVE-2026-22666?
CVE-2026-22666 affects Dolibarr version 23.0.0 and potentially earlier versions.
4
What are the consequences of exploiting CVE-2026-22666?
Exploiting CVE-2026-22666 can lead to unauthorized OS command execution, potentially compromising the server.
5
How does CVE-2026-22666 bypass the whitelist?
CVE-2026-22666 bypasses the whitelist due to the blocklist only being enforced in blacklist mode and not interacting with the dynamic callable syntax.