Loading vulnerability…
Authenticated RCE in Dolibarr ERP/CRM dol_eval_standard()
CVE-2026-22666 is an authenticated remote code execution vulnerability affecting Dolibarr ERP/CRM versions prior to 23.0.2. The flaw is in the dol_eval_standard() evaluation logic. In the default whitelist mode, the function does not enforce the forbidden string checks associated with $forbiddenphpstrings, and its whitelist regex also fails to detect PHP dynamic callable syntax such as (('exec')('cmd')). An attacker with administrator privileges can supply malicious expressions through computed extrafields or other code paths that reach eval(), bypass the intended validation, and trigger arbitrary PHP evaluation that results in operating system command execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated administrator-level attacker to achieve arbitrary command execution on the Dolibarr server via eval()-reachable input. Given the stated CVSS impacts (C:H/I:H/A:H), this can result in full compromise of application data, unauthorized modification of records and configuration, execution of arbitrary system commands in the context of the web server or PHP process, and potential service disruption or further host compromise depending on deployment permissions.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to administrator accounts, disable or tightly control computed extrafields and any other features that pass user-controlled expressions into dol_eval_standard() or related eval()-based paths, and monitor for suspicious administrative changes or payloads using dynamic callable syntax. Additional hardening should include minimizing OS-level privileges of the PHP/web server process and applying compensating controls around administrative interfaces, but these measures do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Upgrade Dolibarr ERP/CRM to version 23.0.2 or later, which is referenced as containing the patch for this issue. The fix should ensure forbidden string checks are enforced in whitelist mode and that validation correctly detects and blocks PHP dynamic callable syntax before any expression reaches eval(). Review any customizations or modules that rely on computed extrafields or other evaluation paths to ensure they do not reintroduce unsafe evaluation behavior.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.