---
id: CVE-2026-22666
title: Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
summary: >-
  Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code
  execution vulnerability in the dol_eval_standard() function that fails to
  apply forbidden string checks in whitelist mode and does not detect PHP
  dynamic call…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-95
vendor: Dolibarr
product: Dolibarr ERP/CRM
affected:
  - erp_crm < 23.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-04-07T13:42:40.115120Z'
exploitAvailable: true
published: '2026-04-07'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:01:16.441Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22666'
references:
  - url: >-
      https://jivasecurity.com/writeups/dolibarr-remote-code-execution-cve-2026-22666
  - url: >-
      https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-vmvw-qq8w-wqhg
    label: GitHub Security Advisory (GHSA-vmvw-qq8w-wqhg)
  - url: >-
      https://github.com/Dolibarr/dolibarr/commit/6f425521b3e6f9f27eca05228e02093dbaa40dea
  - url: 'https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2'
    label: Dolibarr ERP/CRM 23.0.2 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/dolibarr-erp-crm-authenticated-rce-via-dol-eval-standard
tags:
  - cve.org
  - exploit-available
epss: 0.15787
epssPercentile: 0.96893
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/JivaSecurity/DOLIBARR-RCE-CVE-2026-22666'
  checkedAt: '2026-11-08T14:51:57.352Z'
ingestedAt: '2026-11-08T14:51:22.476Z'
---

## Overview

Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().

## Affected

- `erp_crm < 23.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.