CVE-2025-67486 - Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields

Back Back to CVE browser

HIGH

Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields

Published May 8, 2026

8.6

HIGH

CVSS 4.0

EPSS 0.88%

Description

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's `eval()` function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.

Affected products

Vendor Dolibarr Product Dolibarr Default
n/a
- Version
  <= 22.0.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dolibarr

n/a

Version	Status	Constraints
<= 22.0.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-74

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-209752
Advisory
https://github.com/Dolibarr/dolibarr/blob/22.0.2/htdocs/core/lib/functions.lib.php
x_refsource_MISCPatch
https://medium.com/@abduxalilovjavohir/dolibarr-erp-authenticated-remote-code-execution-via-eval-injection-in-user-extrafields-dfc305d0118e
exploitx_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-209752		Advisory
https://github.com/Dolibarr/dolibarr/blob/22.0.2/htdocs/core/lib/functions.lib.php		x_refsource_MISCPatch
https://medium.com/@abduxalilovjavohir/dolibarr-erp-authenticated-remote-code-execution-via-eval-injection-in-user-extrafields-dfc305d0118e		exploitx_refsource_CONFIRMThird Party Advisory