What is the CVSS score of CVE-2026-37711?

CVE-2026-37711 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Dolibarr ERP/CRM are affected by CVE-2026-37711?

Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha contain an unauthenticated code injection vulnerability (CVE-2026-37711) enabling remote PHP execution against business-critical…

How to fix or mitigate CVE-2026-37711?

24 hours: Identify and inventory all Dolibarr instances; determine which systems run versions 22.0.0-22.0.4 or 24.0.0-alpha; assess business criticality. 7 days: Implement network segmentation restricting access to affected instances; deploy WAF rules blocking requests to htdocs/core/actions_addupdatedelete.inc.php; contact vendor for patch timeline. 30 days: Execute upgrade to patched version upon vendor release; if no patch timeline emerges, evaluate ERP/CRM alternatives or implement persistent endpoint controls.

Dolibarr ERP/CRM CVE-2026-37711

HIGH

Code Injection (CWE-94)

2026-05-27 cve@mitre.org

Code Injection RCE PHP

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:13 vuln.today

DescriptionCVE.org

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/actions_addupdatedelete.inc.php

AnalysisAI

Code injection in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha allows a remote, unauthenticated attacker to execute attacker-controlled PHP through the htdocs/core/actions_addupdatedelete.inc.php request handler (CWE-94). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-effort, network-reachable, no-authentication attack, though all impact metrics are rated Low (C:L/I:L/A:L), suggesting the executable surface is constrained rather than full system takeover. There is no public exploit code confirmed in the provided data and the issue is not in CISA KEV (no observed exploitation per SSVC), but a referenced research write-up and a GitHub Security Advisory exist, and SSVC rates the flaw as automatable.

Technical ContextAI

The affected component, htdocs/core/actions_addupdatedelete.inc.php, is a shared Dolibarr action-dispatch include that processes add/update/delete operations across modules. The referenced research write-up ('dol_eval-five-years') points to Dolibarr's long-standing use of its internal dol_eval() expression-evaluation routine, which ultimately resolves user-influenced strings into executable PHP. CWE-94 (Improper Control of Generation of Code, i.e. code injection) describes the root cause: input that should be treated as data is instead incorporated into a code path that PHP evaluates, so an attacker who controls that input controls the code that runs. No CPE strings were supplied in the intelligence, so exact platform/configuration identifiers cannot be cross-referenced beyond the version ranges given.

Affected ProductsAI

Dolibarr ERP/CRM is affected in the stable 22.x branch from v22.0.0 through v22.0.4 inclusive, and in the pre-release v24.0.0-alpha. No CPE strings were included in the source data to further pin platform or edition. The authoritative vendor reference is the GitHub Security Advisory at https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-grw9-6m4w-mhcq, with additional technical detail in the research write-up at https://bryamzxz.github.io/2026/05/25/dol_eval-five-years/.

RemediationAI

Patch available per vendor advisory (GHSA-grw9-6m4w-mhcq); the exact fixed release version was not specified in the provided data, so consult the advisory at https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-grw9-6m4w-mhcq for the patched build and upgrade the 22.x series accordingly, and avoid running the 24.0.0-alpha pre-release in production. Until the patched version is applied, restrict network reachability of the Dolibarr instance to trusted users (place it behind VPN or an authenticating reverse proxy) and use WAF/proxy rules to block direct external requests to core/actions_addupdatedelete.inc.php and related action endpoints - the trade-off is that overly broad rules may break legitimate add/update/delete workflows, so test rules against normal module usage. Where feasible, tighten access controls and disable or lock down any module exposing the vulnerable action path; do not invent a fix version - apply the one named in the advisory.