What is the CVSS score of CVE-2026-37712?

CVE-2026-37712 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Dolibarr ERP/CRM are affected by CVE-2026-37712?

Dolibarr ERP/CRM versions 22.0.0-22.0.4 and 24.0.0-alpha are vulnerable to remote code execution (CVE-2026-37712, CVSS 7.3) without an available patch, putting affected systems at risk of data theft…

How to fix or mitigate CVE-2026-37712?

Within 24 hours: inventory all systems running Dolibarr versions 22.0.0-22.0.4 or 24.0.0-alpha and identify those accessible from untrusted networks. Within 7 days: disable cron job execution if operationally feasible, or restrict execution to authenticated scheduled maintenance windows only; begin compatibility assessment for upgrade to a stable Dolibarr release outside the vulnerable version ranges. Within 30 days: apply vendor-released patch immediately upon availability (monitor security advisories), or complete upgrade to non-vulnerable version; conduct security audit of affected systems for evidence of compromise.

Dolibarr ERP/CRM CVE-2026-37712

HIGH

Code Injection (CWE-94)

2026-05-27 cve@mitre.org

RCE PHP Code Injection

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 19:30 vuln.today

CVSS changed

May 28, 2026 - 17:22 NVD

7.3 (HIGH)

CVE Published

May 27, 2026 - 15:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/cron/class/cronjob.class.php, call_user_func_array() in function job type

AnalysisAI

Remote code execution in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha stems from unsafe use of PHP's call_user_func_array() within the cron job class, enabling attackers to execute arbitrary PHP code on the application server. The vulnerability carries CVSS 7.3 with CWE-94 (Code Injection) classification, and while no public exploit is identified at time of analysis, a security researcher writeup referenced from NVD discusses a five-year history of related dol_eval issues in Dolibarr suggesting recurring weaknesses in this code area. EPSS probability is very low at 0.06% and SSVC reports no observed exploitation, but the issue is rated automatable with partial technical impact.

Technical ContextAI

Dolibarr is a widely-deployed open-source PHP-based ERP/CRM platform used by SMBs for accounting, inventory, sales, and HR workflows. The flaw resides in htdocs/cron/class/cronjob.class.php, which dispatches scheduled jobs through PHP's call_user_func_array() - a dynamic invocation primitive that executes the callable named by its first argument. CWE-94 (Improper Control of Generation of Code) applies because user- or configuration-supplied data feeding the 'function job type' is reachable by the callable dispatch without sufficient allowlisting, letting an attacker name arbitrary PHP functions and pass arbitrary arguments. The referenced researcher post titled 'dol_eval-five-years' indicates this is part of a recurring pattern in Dolibarr's evaluation/dispatch surface rather than an isolated bug.

Affected ProductsAI

Dolibarr ERP/CRM stable branch versions 22.0.0, 22.0.1, 22.0.2, 22.0.3, and 22.0.4 are affected, along with the pre-release 24.0.0-alpha. No CPE strings were provided in the input data. The vendor security advisory is published at https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-c2jp-w9cj-6cx4 and should be consulted for the canonical affected-version list and fix tags.

RemediationAI

Upgrade to a fixed release as listed in the Dolibarr GHSA advisory at https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-c2jp-w9cj-6cx4 - no exact fix version was provided in the input data, so administrators should consult that advisory directly to identify the patched 22.0.x release and skip the 24.0.0-alpha pre-release. Patch status: upstream fix available per the vendor security advisory; an exact released patched version is not independently confirmed from the provided data. As a compensating control until upgrade, restrict access to the cron management UI (htdocs/cron/*) to a hardened admin allowlist via web server ACLs or reverse-proxy rules, disable or remove the 'function' job type if cron jobs of type 'command' or 'method' suffice for your workflows (trade-off: any existing function-type jobs stop running), and audit existing cron jobs for unexpected function names or arguments. Avoid exposing the Dolibarr admin interface to the public internet; place it behind a VPN or IP allowlist while patching is scheduled. Review the referenced researcher writeup at https://bryamzxz.github.io/2026/05/25/dol_eval-five-years/ for related dol_eval sinks that may warrant additional hardening.