# CVE-2026-37713: Dolibarr ERP/CRM PHP code execution in CommonObject class

Source: https://junglewise.ai/threats/cve-2026-37713-dolibarr-erp-crm-php-code-execution-in-commonobject-class  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-37713 · Severity: info · CVSS 8.1 · Published 2026-05-27

Dolibarr ERP/CRM, a popular open-source suite for managing business operations, contains a security vulnerability that allows attackers to execute unauthorized code. By exploiting a flaw in how the system handles computed data fields, an attacker with basic user access can run custom PHP scripts on the server. This could lead to the theft of sensitive business data, modification of financial records, or a complete takeover of the application server.

Technologies: [Dolibarr ERP CRM](https://junglewise.ai/threats/technologies/erp-crm). Vendors: [Dolibarr](https://junglewise.ai/threats/vendors/dolibarr).

## Quick answers

**Is CVE-2026-37713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37713 being exploited in the wild.

**How severe is CVE-2026-37713?** Informational severity, with a CVSS score of 8.1, published 27 May 2026.

**Which products and versions are affected?** Dolibarr ERP CRM 22.0.0 - 22.0.4, 24.0.0-alpha.

**Is there a fix for CVE-2026-37713?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-37713 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-37713?** Check whether you run Dolibarr ERP CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a PHP code injection (CWE-95) located in 'htdocs/core/class/commonobject.class.php'. It stems from the use of the 'dol_eval()' wrapper, which internally calls the native PHP 'eval()' function to process dynamic expressions for computed extrafields and business object attributes. While Dolibarr employs a function blacklist to prevent dangerous calls, this implementation is bypassable or can be chained with other vulnerabilities (like CVE-2026-37712) to achieve full OS command execution. An authenticated attacker can reach this sink by supplying malicious PHP code to fields that are subsequently evaluated by the 'CommonObject' class. The issue persists because the software relies on incremental blacklist updates rather than migrating to safer evaluation methods.

## Affected products

- Dolibarr Dolibarr ERP/CRM 22.0.0 - 22.0.4, 24.0.0-alpha

## Timeline

- 2026-04-10: other: CVE assigned by MITRE
- 2026-05-25: disclosed: Full technical write-up published by researcher
- 2026-05-27: advisory: NVD publication date

## References

- [https://bryamzxz.github.io/2026/05/25/dol_eval-five-years/](https://bryamzxz.github.io/2026/05/25/dol_eval-five-years/)
- [https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-cq92-jp5j-rwvj](https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-cq92-jp5j-rwvj)

## Related threats

- [Dolibarr ERP CRM missing authorization in recruitment module](https://junglewise.ai/threats/cve-2026-118754-dolibarr-erp-crm-before-24-0-2-contains-a-missing-authorization)
- [Dolibarr ERP CRM OS command injection in export.php](https://junglewise.ai/threats/cve-2026-116219-dolibarr-erp-crm-before-24-0-0-contains-an-os-command-injection)
- [Dolibarr ERP CRM SQL injection in company bank accounts API](https://junglewise.ai/threats/cve-2026-116218-dolibarr-erp-crm-19-0-0-before-23-0-4-contains-an-sql-injection)
- [Dolibarr ERP CRM authorization bypass in extrafield update](https://junglewise.ai/threats/cve-2026-107706-dolibarr-erp-crm-before-24-0-2-contains-an-incorrect)
- [Dolibarr ERP CRM improper authorization in Leave Request REST API](https://junglewise.ai/threats/cve-2026-10215-dolibarr-erp-crm-improper-authorization-in-leave-request-rest-api)