CVE-2025-67486 - CVE House
Back to Database
Status published High CVE-2025-67486

Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields

Vulnerability Description

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's `eval()` function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-67486

Credits & Attribution

No credits recorded in the NVD database.

References

More from Dolibarr

View All →
CVE-2024-5315
Multiple vulnerabilities in DOLIBARR's ERP CMS
Critical 9.1
CVE-2024-5314
Multiple vulnerabilities in DOLIBARR's ERP CMS
Critical 9.1
CVE-2024-23817
Dolibarr Application Home Page HTML injection vulnerability
High 7.1
CVE-2023-4198
Dolibarr ERP CRM (<= 17.0.3) Improper Access Control
Medium 6.5
CVE-2023-4197
Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE
High 7.5

Affected Vendor

Affected Software

dolibarr
Vulnerable Versions:
<= 22.0.2

Timeline

Official Publish: May 8th, 2026
Last Modified: May 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-74

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1213 Data from Information Repositories
Collection