CVE-2026-22666

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22666
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22666.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22666
Aliases
  • GHSA-vmvw-qq8w-wqhg
Downstream
Published
2026-04-07T12:41:31.280Z
Modified
2026-07-08T08:12:41.344237275Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
Details

Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dolevalstandard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22666.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-95"
    ]
}
References

Affected packages

Git / github.com/dolibarr/dolibarr

Affected ranges

Type
GIT
Repo
https://github.com/dolibarr/dolibarr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ccef1102e6850b7545be7bad91cf0cc4c74ac6ea
Fixed
6f425521b3e6f9f27eca05228e02093dbaa40dea
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:dolibarr:dolibarr_erp\\/crm:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "23.0.2"
        }
    ]
}

Affected versions

14.*
14.0.0
14.0.1
23.*
23.0.0
23.0.1
3.*
3.3.beta1_20121221
3.4.beta1_20130429
3.4.beta1_20130502
3.5.beta1_20131106
3.5.beta1_20131120
3.6.0
3.6.0-alpha
3.6.0-beta
3.6.1
3.6.2
3.6.beta1_20140514
3.7.0
3.7.1
3.8.0-beta
4.*
4.0.0-rc
5.*
5.0.0-beta
6.*
6.0.0-beta

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22666.json"