Loading vulnerability…
CVE-2026-22666 is an authenticated remote code execution vulnerability affecting Dolibarr ERP/CRM versions prior to 23.0.2. The flaw is in the dol_eval_standard() evaluation logic. In the default whitelist mode, the function does not enforce the forbidden string checks associated with $forbiddenphpstrings, and its whitelist regex also fails to detect PHP dynamic callable syntax such as (('exec')('cmd')). An attacker with administrator privileges can supply malicious expressions through computed extrafields or other code paths that reach eval(), bypass the intended validation, and trigger arbitrary PHP evaluation that results in operating system command execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Single-file Python exploit PoC targeting Dolibarr 23.0.0, specifically a whitelist bypass in dol_eval_standard() that allegedly enables authenticated remote code execution via computed extrafields. The repository contains one standalone script, dolibarr_rce_poc_jivasecurity_CVE-2026-22666.py, which uses the requests library to automate the full attack chain against the Dolibarr web UI. The exploit structure is straightforward: it authenticates to the target web application, scrapes a CSRF token from HTML, accesses the extrafields administration page, determines whether a chosen extrafield already exists, then creates or updates a computed extrafield with a malicious PHP expression payload. It subsequently triggers evaluation through the company listing page (/societe/list.php). The script description and output indicate three main exploit capabilities: bypassing whitelist validation using PHP dynamic callable syntax, executing OS commands via constructs like ('exec')('cmd'), and abusing PHP classes/ORM objects for arbitrary file creation and database-backed data exfiltration. The PoC specifically reports exfiltration of an admin API key as a demonstrated result. Operationally, this is an authenticated web exploit rather than a scanner or detector. It requires valid credentials and likely administrative privileges to manage extrafields. It is not part of a larger exploitation framework. The code includes argument parsing, session handling, CSRF extraction, login logic, extrafield manipulation, trigger execution, and optional cleanup. Overall, the repository’s purpose is to provide a practical proof of concept for exploiting Dolibarr’s computed extrafield evaluation path to achieve authenticated RCE and sensitive data access.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in Dolibarr 23.0.0 caused by a dol_eval() whitelist bypass that, combined with blind spots in whitelist regex handling of PHP dynamic callable syntax, can lead to OS command execution.
An authenticated remote code execution vulnerability in Dolibarr ERP/CRM's dol_eval_standard() function that allows an administrator to bypass validation using PHP dynamic callable syntax and achieve arbitrary command execution via eval().
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.