Executive brief
Dolibarr ERP/CRM, a popular open-source suite for managing business operations, contains a security vulnerability that allows attackers to execute unauthorized code. By exploiting a flaw in how the system handles computed data fields, an attacker with basic user access can run custom PHP scripts on the server. This could lead to the theft of sensitive business data, modification of financial records, or a complete takeover of the application server.
Technical details
The vulnerability is a PHP code injection (CWE-95) located in 'htdocs/core/class/commonobject.class.php'. It stems from the use of the 'dol_eval()' wrapper, which internally calls the native PHP 'eval()' function to process dynamic expressions for computed extrafields and business object attributes. While Dolibarr employs a function blacklist to prevent dangerous calls, this implementation is bypassable or can be chained with other vulnerabilities (like CVE-2026-37712) to achieve full OS command execution. An authenticated attacker can reach this sink by supplying malicious PHP code to fields that are subsequently evaluated by the 'CommonObject' class. The issue persists because the software relies on incremental blacklist updates rather than migrating to safer evaluation methods.
Affected products
- Dolibarr Dolibarr ERP/CRM 22.0.0 - 22.0.4, 24.0.0-alpha
Timeline
- 2026-04-10: other: CVE assigned by MITRE
- 2026-05-25: disclosed: Full technical write-up published by researcher
- 2026-05-27: advisory: NVD publication date