CVE-2026-22666 is an authenticated remote code execution vulnerability in Dolibarr ERP/CRM prior to version 23.0.2. The issue exists in the dol_eval_standard() function, which improperly neutralizes directives in dynamically evaluated PHP code (CWE-95). Specifically, it fails to enforce forbidden string checks when operating in whitelist mode and does not detect PHP dynamic callable syntax. This allows attackers with administrator privileges to inject malicious PHP code through computed extrafields or other evaluation paths, bypassing validation and achieving arbitrary command execution via eval(). The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity. No patch or official remediation level is currently documented.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary PHP code remotely on the affected Dolibarr ERP/CRM system. This can lead to full system compromise, data theft, or disruption of service. The vulnerability requires authenticated access with high privileges, limiting exposure to trusted users or compromised administrator accounts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to computed extrafields or dynamic code evaluation. Avoid enabling or using features that rely on dynamic evaluation of PHP code if possible.