EUVD-2026-19606
GHSA-m6qg-6w6h-v59x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().
Articles & Coverage 1
AnalysisAI
Remote code execution in Dolibarr ERP/CRM versions prior to 23.0.2 allows authenticated administrators to execute arbitrary system commands by exploiting inadequate input validation in the dol_eval_standard() function. The vulnerability enables attackers to bypass security controls using PHP dynamic callable syntax through computed extrafields or other evaluation paths. With a CVSS score of 7.2 and publicly available exploit code documented by Jiva Security, this represents an elevated risk for organizations running unpatched Dolibarr instances, though exploitation requires high-privilege administrator access (CVSS:3.1/PR:H), limiting the attack surface to insider threats or compromised admin accounts.
Technical ContextAI
Dolibarr ERP/CRM is an open-source business management application written in PHP. This vulnerability resides in the dol_eval_standard() function, which performs dynamic code evaluation using PHP's eval() construct. The function implements two security modes: a blacklist mode and a whitelist mode intended to restrict dangerous operations. The flaw occurs because the whitelist mode fails to properly validate against forbidden string patterns and does not detect PHP dynamic callable syntax-a feature allowing strings to be treated as function names (e.g., variable functions like $func='system'; $func('command')). This enables attackers to construct payloads that pass validation checks but still execute arbitrary code. The vulnerability is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), commonly known as code injection. Attack vectors include computed extrafields (custom database fields with dynamic expressions) and other code paths that invoke dol_eval_standard() with attacker-controlled input. The affected product CPE is cpe:2.3:a:dolibarr:dolibarr_erp/crm, impacting all versions before the 23.0.2 security release.
RemediationAI
Vendor-released patch: Dolibarr version 23.0.2. Organizations running affected versions should immediately upgrade to Dolibarr ERP/CRM 23.0.2 or later, available from the official GitHub release at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2. The security fix is implemented in commit 6f425521b3e6f9f27eca05228e02093dbaa40dea, which strengthens input validation in the dol_eval_standard() function to properly detect and block PHP dynamic callable syntax in whitelist mode. For environments unable to immediately upgrade, implement compensating controls including restricting administrator account access to trusted personnel only, enabling comprehensive audit logging for all admin actions especially those involving custom extrafields or computed expressions, enforcing multi-factor authentication for all administrative accounts, and monitoring for unusual eval() function calls in application logs. Review and disable any custom computed extrafields that are not operationally required. Consult the official security advisory at https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-vmvw-qq8w-wqhg and VulnCheck's analysis at https://www.vulncheck.com/advisories/dolibarr-erp-crm-authenticated-rce-via-dol-eval-standard for additional technical details.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today