CVE-2026-37711

Vulnerability

Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha contain a PHP code injection vulnerability (CWE-94) in the dol_eval() function, invoked via the file htdocs/core/actions_addupdatedelete.inc.php. The vulnerability arises because user-supplied input is passed to dol_eval(), a wrapper around PHP's eval(), without adequate sanitization. The code path is reachable by default in the stable 22.x series; in the 24.0.0-alpha branch, reachability depends on the specific configuration. The dol_eval() function employs a blacklist of forbidden functions and characters, but this blacklist has been repeatedly bypassed over the years, as documented in the reference [1].

Exploitation

An unauthenticated remote attacker can trigger the vulnerable code path by sending crafted HTTP requests to the affected endpoint. The attacker does not require any prior authentication or special privileges. The exploitation sequence involves injecting PHP code into a parameter that is subsequently evaluated by dol_eval(). While the blacklist may block certain function names (e.g., exec, system), other PHP functions remain available, and the attacker can leverage chained vulnerabilities (such as CVE-2026-37712) to achieve OS-level command execution once arbitrary PHP code execution is obtained [1]. No user interaction is required.

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code in the context of the web server. This can lead to full compromise of the Dolibarr instance, including disclosure of sensitive data (e.g., database credentials, user information), modification or deletion of records, and, when chained with additional primitives, execution of arbitrary operating system commands. The impact is rated as critical, with a high CVSS score (not explicitly stated but implied by the nature of the vulnerability). The attacker effectively gains the same privileges as the web server user, which can be elevated through further attacks [1].

Mitigation

As of the publication date of the reference (May 25, 2026), no official patch or updated version addressing CVE-2026-37711 has been released by Dolibarr. The vendor has historically addressed such issues by expanding the blacklist in dol_eval(), but this pattern has proven insufficient. Users are advised to monitor the Dolibarr project for a future release that incorporates a more robust solution (e.g., removing eval() entirely or shifting to a sandboxed expression parser). Until a fix is available, restricting network access to the Dolibarr instance and applying web application firewall (WAF) rules to block suspicious input may serve as partial mitigation. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].