CVE-2026-22666
Last modified
CVE-2026-22666 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().. EPSS estimates a 15.53% chance of exploitation in the next 30 days.
Description
Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dolibarr | Dolibarr Erp\/Crm | < 23.0.2 |
References
- https://jivasecurity.com/writeups/dolibarr-remote-code-execution-cve-2026-22666Exploit, Third Party Advisory
- https://www.vulncheck.com/advisories/dolibarr-erp-crm-authenticated-rce-via-dol-eval-standardThird Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-22666?
How severe is CVE-2026-22666?
How do I fix CVE-2026-22666?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-22660FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a l…8.6
- CVE-2026-22661prompts.chat prior to commit 0f8d4c3 contains a path travers…8.6
- CVE-2026-22662prompts.chat prior to commit 1464475 contains a blind server…5.3
- CVE-2026-22663prompts.chat prior to commit 7b81836 contains multiple autho…8.7
- CVE-2026-22664prompts.chat prior to commit 30a8f04 contains a server-side …7.7
- CVE-2026-22665prompts.chat prior to commit 1464475, contains an identity c…8.6
- CVE-2026-22674Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, c…4.8
- CVE-2026-22675OCS Inventory NG Server version 2.12.3 and prior contain a s…6.1
- CVE-2026-22676Barracuda RMM versions prior to 2025.2.2 contain a privilege…8.5
- CVE-2026-22677Hermes WebUI prior to 0.51.44 contains a path traversal vuln…6.5
- CVE-2026-22678Webmin before 2.641 contains a stored cross-site scripting v…5.4
- CVE-2026-22679Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 con…9.8
Are you affected by CVE-2026-22666?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST