Is CVE-2026-37711 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37711 being exploited in the wild.

How severe is CVE-2026-37711?

Informational severity, with a CVSS score of 9.1, published 27 May 2026.

Which products and versions are affected?

Dolibarr 22.0.0 - 22.0.4, 24.0.0-alpha.

Is there a fix for CVE-2026-37711?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37711 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-37711?

Check whether you run Dolibarr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37711: Dolibarr ERP/CRM remote code execution in actions_addupdatedelete.inc.php

CVE-2026-37711 · Severity: info · CVSS 9.1 · Published 2026-05-27

Dolibarr ERP/CRM, a popular open-source suite for managing business operations, contains a critical security flaw that allows remote attackers to execute unauthorized code on the server. By sending a specially crafted request to a specific internal component, an attacker can take full control of the application and the underlying server. This could lead to the theft of sensitive business data, complete service disruption, or the installation of ransomware.

Technologies: Dolibarr. Vendors: Dolibarr.

Quick answers

Is CVE-2026-37711 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37711 being exploited in the wild.
How severe is CVE-2026-37711?: Informational severity, with a CVSS score of 9.1, published 27 May 2026.
Which products and versions are affected?: Dolibarr 22.0.0 - 22.0.4, 24.0.0-alpha.
Is there a fix for CVE-2026-37711?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37711 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-37711?: Check whether you run Dolibarr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a PHP code injection (CWE-94) located in 'htdocs/core/actions_addupdatedelete.inc.php'. The root cause is the unsafe use of the 'dol_eval()' function, which acts as a wrapper for PHP's native 'eval()'. The application fails to properly sanitize or validate input before passing it to this function at approximately 31 different call sites. An attacker can exploit this by providing a malicious PHP payload via HTTP parameters that are processed by this include file, which is used by over 120 different files across the application. This allows for arbitrary code execution with the privileges of the web server user. The issue stems from a long-standing architectural reliance on a function blacklist that has proven insufficient to prevent injection.

Affected products

Dolibarr Dolibarr ERP/CRM 22.0.0 - 22.0.4, 24.0.0-alpha

Timeline

2026-04-10: other: CVE assigned by MITRE
2026-05-25: disclosed: Full technical disclosure by researcher Bryam Vargas
2026-05-27: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.