CVE-2026-37713

Vulnerability

CVE-2026-37713 is a PHP code-execution vulnerability (CWE-95) in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha. The vulnerability resides in htdocs/core/class/commonobject.class.php, where a stored dol_eval() chain is reachable without authentication. The dol_eval() function wraps PHP's eval() using a blacklist-based approach, but this CVE bypasses the blacklist through a passive stored chain in the base business object class [1].

Exploitation

To exploit CVE-2026-37713, an attacker needs network access to the Dolibarr instance. No authentication is required because the vulnerable code path is triggered when processing stored data from extrafields, dynamic visibility rules, or menu permissions. The attacker can supply a crafted expression that, when evaluated by dol_eval() via the commonobject.class.php chain, results in execution of arbitrary PHP code [1].

Impact

Successful exploitation allows a remote attacker to execute arbitrary PHP code within the context of the web server. This leads to full information disclosure, data manipulation, and potential server compromise. Although OS command execution is blocked by the function-name deny-list in the dol_eval() wrapper, CVE-2026-37713 can be chained with CVE-2026-37712 (an OS command execution via call_user_func_array()) to achieve full remote code execution at the operating system level [1].

Mitigation

As of the publication date (2026-05-27), no patch is available for CVE-2026-37713. The Dolibarr project has historically addressed dol_eval() vulnerabilities through blacklist expansion rather than architectural changes, leaving the codebase perennially at risk. Users are advised to apply any future updates that remove or replace dol_eval() entirely, and to restrict network access to the Dolibarr instance as a workaround [1].