What is the CVSS score of CVE-2026-37713?

CVE-2026-37713 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Dolibarr ERP/CRM are affected by CVE-2026-37713?

Dolibarr ERP/CRM versions 22.0.0-22.0.4 and 24.0.0-alpha contain an unauthenticated remote code execution vulnerability in commonobject.class.php that could allow attackers to execute arbitrary code…

How to fix or mitigate CVE-2026-37713?

24 hours: Inventory all Dolibarr instances in production; confirm versions and isolation status; apply network-level access restrictions to affected systems. 7 days: Deploy Web Application Firewall (WAF) rules targeting commonobject.class.php access patterns; evaluate upgrade path to stable release (25.x or latest 24.x stable); restrict external connectivity if possible. 30 days: Complete migration to patched stable Dolibarr release; validate no instances remain on 22.0.0-22.0.4 or 24.0.0-alpha; implement network segmentation for ERP/CRM systems.

Dolibarr ERP/CRM CVE-2026-37713

HIGH

Code Injection (CWE-94)

2026-05-27 cve@mitre.org

RCE PHP Code Injection

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 17:22 vuln.today

CVSS changed

May 28, 2026 - 17:22 NVD

7.3 (HIGH)

CVE Published

May 27, 2026 - 15:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/class/commonobject.class.php.

AnalysisAI

Remote code execution in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha allows network-based attackers to execute arbitrary PHP code via the commonobject.class.php component. The CVSS 7.3 (AV:N/AC:L/PR:N/UI:N) vector indicates no authentication or user interaction is required, though impact metrics are rated Low across CIA. No public exploit identified at time of analysis, and EPSS scoring is very low at 0.06% (18th percentile) despite the unauthenticated network attack surface.

Technical ContextAI

Dolibarr is a popular open-source PHP-based ERP/CRM platform used by small and mid-sized businesses for accounting, inventory, CRM, and HR functionality. The flaw resides in htdocs/core/class/commonobject.class.php, a core class shared across most Dolibarr modules for object lifecycle handling. CWE-94 (Improper Control of Generation of Code, 'Code Injection') indicates user-controlled input flows into a PHP code evaluation construct - likely an eval(), create_function(), or template-evaluation path - without sufficient sanitization. The referenced research blog 'dol_eval-five-years' suggests this is the latest in a long-standing class of eval-related issues in Dolibarr's expression evaluation helpers.

Affected ProductsAI

Dolibarr ERP/CRM stable releases 22.0.0, 22.0.1, 22.0.2, 22.0.3, and 22.0.4 are affected, along with the pre-release 24.0.0-alpha branch. The vulnerable code is located in htdocs/core/class/commonobject.class.php. Vendor advisory is published at https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-cq92-jp5j-rwvj. No CPE strings were provided in the source data.

RemediationAI

Patch availability should be confirmed via the vendor GitHub Security Advisory at https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-cq92-jp5j-rwvj; upgrade to the latest fixed Dolibarr 22.0.x release published after 22.0.4 (released patched version not independently confirmed from the provided data). If immediate upgrade is not possible, restrict network exposure of the Dolibarr web interface by placing it behind a VPN or IP-allowlisted reverse proxy, and enable application-layer authentication enforcement at the proxy to ensure no unauthenticated request can reach commonobject.class.php code paths - the trade-off is loss of public-facing customer/partner access. Review web server logs for anomalous POST requests touching object-handling endpoints and consider WAF rules blocking PHP function names (eval, system, exec, passthru) in request parameters, accepting the false-positive risk on legitimate business data containing those strings. Background research at https://bryamzxz.github.io/2026/05/25/dol_eval-five-years/ provides context on the recurring eval-injection pattern in Dolibarr.