Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()

The impact of CVE-2026-22666 is significant due to its potential for remote code execution. An attacker with administrator access can leverage this vulnerability to execute arbitrary commands on the server hosting Dolibarr. This could involve data exfiltration, modification of sensitive data, installation of malware, or complete system takeover. The ability to bypass validation through computed extrafields makes exploitation relatively straightforward for skilled attackers. The blast radius extends to all data stored within the Dolibarr instance and potentially to other systems accessible from the compromised server, depending on the attacker's actions following initial access. This vulnerability shares similarities with other PHP code injection flaws where improper sanitization of user-supplied data leads to arbitrary code execution.

Organizations heavily reliant on Dolibarr ERP/CRM for critical business processes are particularly at risk. Those running legacy installations or with limited security expertise are also more vulnerable. Shared hosting environments where multiple users share the same server instance are at increased risk, as a compromise of one user's Dolibarr installation could potentially affect others.

• php: Examine Dolibarr logs for unusual PHP function calls, especially within the dolevalstandard() function. Look for patterns indicative of code injection attempts.

grep -i 'dol_eval_standard' /path/to/dolibarr/log/error.log

• generic web: Monitor access logs for requests containing suspicious characters or patterns that might indicate an attempt to inject PHP code.

grep -i 'eval(' /path/to/dolibarr/access.log

• generic web: Check response headers for unexpected content or error messages that could indicate a successful code execution. • linux / server: Use lsof to identify any unexpected PHP processes running with elevated privileges.

lsof -p $(ps aux | grep 'php' | grep 'dolibarr' | awk '{print $2}')

1. 2026-04-07Disclosure

   disclosure

2. 2026-04-07Patch

   patch

1. 予約済み2026-01-08
2. 公開日2026-04-07
3. EPSS 更新日2026-04-15

The primary mitigation for CVE-2026-22666 is to immediately upgrade Dolibarr ERP/CRM to version 23.0.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to administrative functions and carefully review any computed extrafields or evaluation paths for potential vulnerabilities. Implement a Web Application Firewall (WAF) with rules to detect and block attempts to inject PHP code through user input. Monitor Dolibarr logs for suspicious activity, particularly any attempts to execute commands or access sensitive files. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a known malicious payload and verifying that it is properly blocked.