Is CVE-2025-67486 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-67486 being exploited in the wild.

How severe is CVE-2025-67486?

High severity, with a CVSS score of 7.2, published 8 May 2026.

Which products and versions are affected?

Dolibarr ERP/CRM 22.0.2 and earlier.

Is there a fix for CVE-2025-67486?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-67486 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-67486?

Check whether you run Dolibarr Crm, Dolibarr ERP/CRM or Dolibarr Erp\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67486: Dolibarr ERP/CRM remote code execution in user extrafields

CVE-2025-67486 · Severity: high · CVSS 7.2 · Published 2026-05-08

Dolibarr, an open-source software suite for managing business resources and customer relationships, contains a security flaw that allows an administrative user to execute malicious code on the server. By entering specially crafted text into the 'computed value' field within the user settings, an attacker can take full control of the underlying web server. This could lead to the theft of sensitive business data, complete service disruption, or the use of the server as a foothold for further attacks on the corporate network.

Technologies: Dolibarr Crm, Dolibarr ERP/CRM, Dolibarr Erp\. Vendors: Dolibarr.

Quick answers

Is CVE-2025-67486 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-67486 being exploited in the wild.
How severe is CVE-2025-67486?: High severity, with a CVSS score of 7.2, published 8 May 2026.
Which products and versions are affected?: Dolibarr ERP/CRM 22.0.2 and earlier.
Is there a fix for CVE-2025-67486?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-67486 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-67486?: Check whether you run Dolibarr Crm, Dolibarr ERP/CRM or Dolibarr Erp\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated remote code execution (RCE) vulnerability exists in Dolibarr ERP/CRM versions 22.0.2 and earlier. The flaw is located in the 'user extrafields' functionality, where user-provided input in the 'computed value' field is passed directly to the PHP eval() function without sufficient sanitization or validation. An attacker with administrative privileges can exploit this to execute arbitrary PHP code in the context of the web server process. While the attack requires high privileges (PR:H), it allows for complete compromise of the application's confidentiality, integrity, and availability. At the time of the advisory, no official patched version has been released.

Affected products

Dolibarr Dolibarr ERP/CRM 22.0.2 and earlier

Timeline

2026-05-08: disclosed
2026-05-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.