Executive brief
A security vulnerability exists in Dolibarr ERP & CRM, a popular open-source suite for managing business operations like sales and inventory. An authorized user with permission to edit website content can bypass security filters to run unauthorized commands on the underlying server. This could lead to a total takeover of the system, allowing attackers to steal sensitive business data, modify records, or disrupt operations.
Technical details
A Remote Code Execution (RCE) vulnerability exists in the Website module of Dolibarr ERP/CRM versions up to and including 22.0.4. The application implements a blacklist-based filtering mechanism to block dangerous PHP functions (e.g., system, shell_exec, eval) within dynamic web content. However, this filter relies on simple string-based matching which can be bypassed using obfuscation techniques such as string concatenation, encoding, or indirect function invocation. An authenticated attacker with permissions to edit PHP content can leverage these bypasses to execute arbitrary operating system commands with the privileges of the web server. As of the advisory date, the vulnerability is addressed by avoiding blacklist-based security in favor of more robust input validation or disabling dynamic PHP execution.
Affected products
- Dolibarr Dolibarr ERP & CRM <= 22.0.4
Timeline
- 2026-02-06: disclosed: Reported to vendor and MITRE
- 2026-02-12: other: Vendor acknowledged the issue
- 2026-04-07: other: CVE assigned
- 2026-04-21: advisory: NVD publication date