Loading story…
Two high-severity vulnerabilities in Dolibarr ERP/CRM allow authenticated administrators to achieve remote code execution through separate application paths. CVE-2026-22666 affects versions before 23.0.2 and stems from the dol_eval_standard() function, which can be abused through computed extrafields and other evaluation paths because forbidden string checks are not properly enforced in whitelist mode and PHP dynamic callable syntax is not detected. The flaw enables arbitrary command execution via eval() and is classified as CWE-95.
A second issue, CVE-2026-23500, affects versions before 23.0.0 and exposes an OS command injection bug in the ODT-to-PDF conversion workflow in odf.php. The MAIN_ODT_AS_PDF configuration constant is concatenated into a shell command passed to exec() without sanitization, allowing an authenticated administrator to inject shell separators and run arbitrary commands as the web server user when generating an ODT template. The vulnerabilities were addressed in Dolibarr 23.0.0 and 23.0.2, underscoring the need for organizations running Dolibarr to upgrade promptly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
GitHub security advisories received the CVE-2026-23500 record and published references to the advisory and the Dolibarr 23.0.0 release. The CVE describes an authenticated administrator-to-RCE path via unsanitized shell command construction in odf.php.
Dolibarr released version 23.0.0, which fixed an OS command injection vulnerability in odf.php affecting versions prior to 23.0.0. The flaw allowed an authenticated administrator to inject shell commands through the MAIN_ODT_AS_PDF configuration during ODT-to-PDF conversion.
Dolibarr released version 23.0.2 to address CVE-2026-22666, an authenticated remote code execution vulnerability affecting versions before 23.0.2. The bug stemmed from insufficient forbidden-string enforcement and failure to detect PHP dynamic callable syntax in dol_eval_standard().
VulnCheck's disclosure channel received a report for CVE-2026-22666, an authenticated remote code execution flaw in Dolibarr's dol_eval_standard() function. The issue allowed an administrator to bypass validation in whitelist mode and achieve arbitrary code execution via eval().
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-23697** affects **Vtiger CRM** versions up to **8.3.0**, allowing a low-privileged authenticated user to achieve remote code execution through the **Documents** module. The flaw stems from an incomplete extension denylist in `config.inc.php` that does not block `.phar` files, enabling an attacker to upload a malicious archive containing arbitrary PHP code. The issue is classified as **CWE-434** and carries a **CVSS v3.1** score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`.
Jul 7, 2026
FOSSBilling disclosed two critical vulnerabilities that can be chained to give unauthenticated attackers administrative access and remote code execution on billing platforms used by hosting providers. **CVE-2026-27604** is an authorization bypass in versions `0.5.4` through `0.7.2` that lets remote attackers reach privileged `/api/system/*` endpoints because the `system` API role is incorrectly mapped to the cron admin identity. **CVE-2026-28496** is a Twig server-side template injection flaw affecting versions `0.1.0` through `0.7.2`, where templates are rendered without a sandbox, exposing the Twig environment, API context, and the dependency injection container. Researchers said the chain allows attackers to read and modify databases, enumerate administrators, create admin accounts, generate privileged API tokens, poison the Symfony cache used by the extension installer, and install a malicious module to execute code as the web server user. The exposure is significant because affected instances may hold customer PII, billing records, payment processor secrets, hosting control panel credentials, sessions, and API tokens. FOSSBilling patched both issues in version **`0.8.0`** and advised defenders to block external access to `/api/system/*`, restrict API access to trusted IPs, rotate admin and client API tokens, invalidate active sessions, reset high-privilege credentials, audit templates for malicious Twig expressions, and review logs for suspicious `/api/system/` activity.
Jun 29, 2026
A newly recorded vulnerability, **CVE-2026-32968**, affects the `com_mb24sysapi` module and allows **unauthenticated remote code execution** through an OS command injection flaw. The weakness is classified as **CWE-78** and stems from improper neutralization of special elements in OS commands, enabling a remote attacker to execute arbitrary commands and potentially take full control of an affected system. The CVE is described as a variant of `CVE-2020-10383`, carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, and is referenced by CERT VDE advisories **VDE-2026-024** and **VDE-2026-025**. A separate high-severity issue, **CVE-2026-29839**, was recorded for **DedeCMS v5.7.118** in the `/sys_task_add.php` component. The flaw is a **Cross-Site Request Forgery** vulnerability classified as **CWE-352**, and its updated **CVSS v3.1** vector is `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating that successful exploitation could significantly affect confidentiality, integrity, and availability. The record includes references to a public gist and the DedeCMS website, highlighting another internet-exposed web application weakness with potentially serious impact.
Jun 29, 2026