CVE-2026-22666 is an authenticated remote code execution vulnerability in Dolibarr ERP/CRM affecting versions prior to 23.0.2. The issue lies in the dol_eval_standard() function, which inadequately applies forbidden string checks when operating in whitelist mode and fails to detect PHP dynamic callable syntax. This allows attackers with administrator privileges to inject malicious PHP code through computed extrafields or other evaluation paths. The injected code bypasses validation and is executed via the eval() function, leading to arbitrary command execution within the application context.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary PHP code remotely on the affected system. This can lead to full compromise of the application environment, including unauthorized data access, modification, or destruction, and potentially further system-level impact depending on the hosting environment. The vulnerability requires authenticated access with high privileges, limiting exposure to trusted users with admin rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted personnel only and monitor for suspicious activity related to computed extrafields or dynamic code evaluation. Avoid using untrusted input in evaluation functions and consider disabling or restricting the use of dynamic code evaluation features if possible.