Executive brief
Dolibarr, an open-source software suite for managing business resources and customer relationships, contains a security flaw that allows an administrative user to execute malicious code on the server. By entering specially crafted text into the 'computed value' field within the user settings, an attacker can take full control of the underlying web server. This could lead to the theft of sensitive business data, complete service disruption, or the use of the server as a foothold for further attacks on the corporate network.
Technical details
An authenticated remote code execution (RCE) vulnerability exists in Dolibarr ERP/CRM versions 22.0.2 and earlier. The flaw is located in the 'user extrafields' functionality, where user-provided input in the 'computed value' field is passed directly to the PHP eval() function without sufficient sanitization or validation. An attacker with administrative privileges can exploit this to execute arbitrary PHP code in the context of the web server process. While the attack requires high privileges (PR:H), it allows for complete compromise of the application's confidentiality, integrity, and availability. At the time of the advisory, no official patched version has been released.
Affected products
- Dolibarr Dolibarr ERP/CRM 22.0.2 and earlier
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory