VYPR
← All advisories
High severity7.2NVD Advisory· Published May 8, 2026· Updated May 12, 2026

CVE-2025-67486

CVE-2025-67486

Description

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's eval() function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Dolibarr/Dolibarrreferences3 versions
    (expand)+ 2 more
    • (no CPE)
    • cpe:2.3:a:dolibarr:dolibarr_erp\/crm:*:*:*:*:*:*:*:*range: <=22.0.2
    • (no CPE)range: <=22.0.2

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.