CVE-2025-67486

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-67486

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67486.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-67486

Published

2026-05-08T14:21:55.693Z

Modified

2026-08-04T11:49:09.632792034Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields

Details

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's eval() function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.

Database specific

{
    "cwe_ids": [
        "CWE-74"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67486.json"
}

References

Affected packages

Git / github.com/dolibarr/dolibarr

Affected ranges

Type

GIT

Repo

https://github.com/dolibarr/dolibarr

Events

Introduced

Last affected

f70b6b43ecfcebc69264bc008aafcb9b9de2b23c

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "22.0.2"
        }
    ]
}

Affected versions

14.*

14.0.0

14.0.1

22.*

22.0.0

22.0.1

22.0.2

3.*

3.3.beta1_20121221

3.4.beta1_20130429

3.4.beta1_20130502

3.5.beta1_20131106

3.5.beta1_20131120

3.6.0

3.6.0-alpha

3.6.0-beta

3.6.1

3.6.2

3.6.beta1_20140514

3.7.0

3.7.1

3.8.0-beta

4.*

4.0.0-rc

5.*

5.0.0-beta

6.*

6.0.0-beta

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67486.json"