# CVE-2025-56588: Dolibarr ERP & CRM remote code execution in User module computed field

Source: https://junglewise.ai/threats/cve-2025-56588-dolibarr-erp-crm-remote-code-execution-in-user-module-computed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-01. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-56588 · Severity: high · CVSS 8.8 · Published 2025-10-01

Dolibarr ERP & CRM, a popular open-source suite for managing business operations and customer relationships, contains a security flaw in its User module. An attacker with administrative access can exploit the 'computed field' feature to run unauthorized commands on the underlying server. This could lead to a complete takeover of the application, theft of sensitive business data, or disruption of operations.

Technologies: [Dolibarr Crm](https://junglewise.ai/threats/technologies/crm), [Dolibarr Erp\](https://junglewise.ai/threats/technologies/dolibarr-erp), [Dolibarr ERP CRM](https://junglewise.ai/threats/technologies/erp-crm), [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr). Vendors: [Dolibarr](https://junglewise.ai/threats/vendors/dolibarr), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2025-56588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-56588 being exploited in the wild.

**How severe is CVE-2025-56588?** High severity, with a CVSS score of 8.8, published 1 October 2025.

**Which products and versions are affected?** Dolibarr ERP CRM 21.0.1; dolibarr/dolibarr (Packagist) ECOSYSTEM:introduced=0,fixed=21.0.3.

**Is there a fix for CVE-2025-56588?** Yes. dolibarr/dolibarr (Packagist): upgrade to 21.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-56588 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-56588?** Check whether you run Dolibarr Crm, Dolibarr Erp\, Dolibarr ERP CRM or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dolibarr/dolibarr (Packagist): upgrade to 21.0.3 or later

  ```sh
  composer require dolibarr/dolibarr:^21.0.3
  ```


## Technical details

A remote code execution (RCE) vulnerability exists in Dolibarr ERP & CRM v21.0.1 within the User module's extra fields configuration. The flaw is classified as a code injection (CWE-94) where administrator-defined expressions in 'computed fields' are improperly sanitized before evaluation during page rendering. This vulnerability specifically bypasses previous mitigations implemented for CVE-2024-40137. While the CVSS vector suggests a requirement for user interaction, the primary attack vector involves an authenticated administrator modifying field parameters to achieve server-side execution. A patch has been committed to the Dolibarr GitHub repository to address this issue.

## Affected products

- Dolibarr Dolibarr ERP & CRM 21.0.1

## Identifiers

- CVE-2025-56588
- GHSA-27hj-48r9-x2vx

## Timeline

- 2025-07-12: disclosed: Reported to vendor and MITRE
- 2025-09-29: patched: Patch committed to GitHub repository
- 2025-10-01: advisory: CVE published by NVD

## References

- [https://github.com/PhDg1410/Research](https://github.com/PhDg1410/Research)

## Related threats

- [Dolibarr SQL injection in localtax parameters](https://junglewise.ai/threats/cve-2026-33944-dolibarr-has-sql-injection-in-societe-class-societe-class-php-via)
- [Dolibarr ERP CRM missing authorization in recruitment module](https://junglewise.ai/threats/cve-2026-118754-dolibarr-erp-crm-before-24-0-2-contains-a-missing-authorization)
- [Dolibarr ERP CRM OS command injection in export.php](https://junglewise.ai/threats/cve-2026-116219-dolibarr-erp-crm-before-24-0-0-contains-an-os-command-injection)
- [Dolibarr ERP CRM SQL injection in company bank accounts API](https://junglewise.ai/threats/cve-2026-116218-dolibarr-erp-crm-19-0-0-before-23-0-4-contains-an-sql-injection)
- [Dolibarr ERP CRM authorization bypass in extrafield update](https://junglewise.ai/threats/cve-2026-107706-dolibarr-erp-crm-before-24-0-2-contains-an-incorrect)