Dolibarr ERP/CRM Flaws Let Admins Trigger Remote Code Execution
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 7, 2026
Two high-severity vulnerabilities in Dolibarr ERP/CRM allow authenticated administrators to achieve remote code execution through separate application paths. CVE-2026-22666 affects versions before 23.0.2 and stems from the dol_eval_standard() function, which can be abused through computed extrafields and other evaluation paths because forbidden string checks are not properly enforced in whitelist mode and PHP dynamic callable syntax is not detected. The flaw enables arbitrary command execution via eval() and is classified as CWE-95.
A second issue, CVE-2026-23500, affects versions before 23.0.0 and exposes an OS command injection bug in the ODT-to-PDF conversion workflow in odf.php. The MAIN_ODT_AS_PDF configuration constant is concatenated into a shell command passed to exec() without sanitization, allowing an authenticated administrator to inject shell separators and run arbitrary commands as the web server user when generating an ODT template. The vulnerabilities were addressed in Dolibarr 23.0.0 and 23.0.2, underscoring the need for organizations running Dolibarr to upgrade promptly.
