Which versions of Dolibarr ERP/CRM are affected by EUVD-2025-209752?

CVE-2025-67486 is a remote code execution vulnerability in Dolibarr ERP/CRM through version 22.0.2 that allows authenticated administrators to execute arbitrary PHP code via malicious input in user…

How to fix or mitigate EUVD-2025-209752?

Within 24 hours: Audit all Dolibarr administrator accounts for unauthorized access, review admin activity logs for suspicious extrafield modifications, and restrict admin access to essential personnel only. Within 7 days: Update to Dolibarr 22.0.3 or later if available, or contact vendor for confirmed patched version; if upgrade is unavailable, implement input validation rules and disable extrafield functionality for non-critical use cases. Within 30 days: Conduct security training on admin account hygiene, implement multi-factor authentication for all admin accounts, and establish real-time monitoring and alerting for extrafield configuration changes.

Dolibarr ERP/CRM EUVD-2025-209752

Q: What is the CVSS score of EUVD-2025-209752?

EUVD-2025-209752 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2025-67486 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-08 GitHub_M

PHP RCE

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 15:46 vuln.today

CVSS changed

May 08, 2026 - 15:22 NVD

8.6 (HIGH)

CVE Published

May 08, 2026 - 14:21 nvd

HIGH 8.6

DescriptionGitHub Advisory

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's eval() function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.

AnalysisAI

Remote code execution in Dolibarr ERP/CRM versions ≤22.0.2 allows authenticated administrators to execute arbitrary PHP code by injecting malicious payloads into the 'computed value' field of user extrafields, which are passed unsanitized to PHP's eval() function. No vendor patch exists at time of analysis (zero-day status), but exploitation requires high-privilege administrator access, limiting immediate risk to environments with compromised admin accounts or malicious insiders. EPSS data unavailable; not listed in CISA KEV, indicating no confirmed widespread exploitation despite public technical disclosure.

Technical ContextAI

This vulnerability affects Dolibarr's user extrafields feature, specifically the computed value functionality in htdocs/core/lib/functions.lib.php. Extrafields allow administrators to add custom calculated fields to user records. The application passes user-supplied expressions from the 'computed value' field directly to PHP's eval() function without input validation or sanitization. This represents a classic CWE-74 (Improper Neutralization of Special Elements in Output) injection vulnerability. The eval() function executes arbitrary PHP code as strings, making it inherently dangerous when processing untrusted input. The affected codebase (cpe:2.3:a:dolibarr:dolibarr) is written in PHP, and the vulnerable code path is triggered during extrafield computation operations within the administrative interface.

RemediationAI

No vendor-released patch exists at time of analysis. Until an official fix is available, implement these compensating controls: (1) Restrict administrative access to Dolibarr to only essential personnel using principle of least privilege, enforced through application-level role restrictions and network segmentation. (2) Disable or restrict access to the user extrafields computed value feature at the application or web server level if not operationally required - this may impact custom field calculation functionality. (3) Implement comprehensive audit logging for all administrative actions, particularly modifications to user extrafields, to detect potential exploitation attempts. (4) Deploy web application firewall (WAF) rules to inspect POST requests to extrafield endpoints for suspicious PHP function names (eval, system, exec, shell_exec) though determined attackers may use obfuscation. (5) Monitor Dolibarr's GitHub repository (https://github.com/Dolibarr/dolibarr) and security mailing lists for patch announcements. Consider engaging with the Dolibarr development community to prioritize remediation given the public disclosure at https://medium.com/@abduxalilovjavohir/dolibarr-erp-authenticated-remote-code-execution-via-eval-injection-in-user-extrafields-dfc305d0118e. Organizations with high-risk profiles should evaluate temporarily disabling the Dolibarr instance until patches are available.