Platform
php
Component
dolibarr
Fixed in
23.0.2
CVE-2026-22666 describes a remote code execution (RCE) vulnerability affecting Dolibarr ERP/CRM versions from 0.0.0 through 23.0.2. This vulnerability arises from insufficient input validation within the dolevalstandard() function, allowing attackers to bypass security measures and execute arbitrary commands. Successful exploitation requires administrator privileges and can lead to complete system compromise. A patch is available in version 23.0.2.
The impact of CVE-2026-22666 is significant due to its potential for remote code execution. An attacker with administrator access can leverage this vulnerability to execute arbitrary commands on the server hosting Dolibarr. This could involve data exfiltration, modification of sensitive data, installation of malware, or complete system takeover. The ability to bypass validation through computed extrafields makes exploitation relatively straightforward for skilled attackers. The blast radius extends to all data stored within the Dolibarr instance and potentially to other systems accessible from the compromised server, depending on the attacker's actions following initial access. This vulnerability shares similarities with other PHP code injection flaws where improper sanitization of user-supplied data leads to arbitrary code execution.
CVE-2026-22666 was publicly disclosed on 2026-04-07. Its inclusion in the CISA KEV catalog is pending. Currently, no public proof-of-concept (PoC) exploits have been widely reported, but the vulnerability's ease of exploitation suggests it may become a target for opportunistic attackers. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns.
Exploit Status
EPSS
0.15% (36% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-22666 is to immediately upgrade Dolibarr ERP/CRM to version 23.0.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to administrative functions and carefully review any computed extrafields or evaluation paths for potential vulnerabilities. Implement a Web Application Firewall (WAF) with rules to detect and block attempts to inject PHP code through user input. Monitor Dolibarr logs for suspicious activity, particularly any attempts to execute commands or access sensitive files. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a known malicious payload and verifying that it is properly blocked.
Update Dolibarr ERP/CRM to version 23.0.2 or higher to mitigate the remote code execution vulnerability. The update corrects the flaw in the dol_eval_standard() function that allowed malicious code injection through calculated extrafields.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-22666 is a remote code execution vulnerability in Dolibarr ERP/CRM versions 0.0.0–23.0.2, allowing attackers with admin access to execute arbitrary commands.
If you are running Dolibarr ERP/CRM versions 0.0.0 through 23.0.2, you are potentially affected by this vulnerability.
Upgrade Dolibarr ERP/CRM to version 23.0.2 or later to remediate the vulnerability. Consider temporary workarounds if immediate upgrade is not possible.
While no widespread exploitation has been confirmed, the vulnerability's ease of exploitation suggests it may become a target for attackers.
Refer to the official Dolibarr security advisory for detailed information and updates: [https://www.dolibarr.org/security/](https://www.dolibarr.org/security/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.