CVE-2026-22666 in the critical feed json
Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
published 2026-04-07 7 mo ago modified 2026-11-08 20 h ago also EUVD-2026-19606
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.8%
- EPSS 15.8% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().
Patch / fix
- Dolibarr Dolibarr ERP/CRM 23.0.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
15.79% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- jivasecurity.com https://jivasecurity.com/writeups/dolibarr-remote-code-execution-cve-2026-22666 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Dolibarr Dolibarr ERP/CRM
Classification
References
-
github.com
/Dolibarr/dolibarr/commit/6f425521b3e6f9f27eca05228e02093dbaa40dea
patch
-
jivasecurity.com
/writeups/dolibarr-remote-code-execution-cve-2026-22666
technical-description, exploit, third-party-advisory
-
github.com
/Dolibarr/dolibarr/security/advisories/GHSA-vmvw-qq8w-wqhg
vendor-advisory, broken-link
-
github.com
/Dolibarr/dolibarr/releases/tag/23.0.2
release-notes
-
vulncheck.com
/advisories/dolibarr-erp-crm-authenticated-rce-via-dol-eval-standard
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2026-22666
- NVD CVE-2026-22666
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.