CVE-2026-37713 Details

A vulnerability allowing remote code execution has been identified in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4, as well as in version 24.0.0-alpha under certain conditions. The issue arises from the 'dol_eval()' function, which is a wrapper around PHP's 'eval()' and is used to evaluate dynamic expressions throughout the application. In the affected versions, an administrator can inject PHP code into specific database fields, which is then executed when the application processes those fields. This vulnerability can be exploited by chaining it with another vulnerability in the same application that allows execution of operating system commands.

To address this vulnerability, Dolibarr should replace the 'dol_eval()' function with a safer, purpose-built expression evaluator that does not use PHP's 'eval()'. Additionally, the application should implement a strict allowlist for method names in scheduled jobs to prevent unauthorized command execution.