CVE-2026-22666 is an authenticated remote code execution vulnerability in Dolibarr ERP/CRM prior to version 23.0.2. The flaw exists in the dol_eval_standard() function, which fails to properly apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. This allows attackers with administrator privileges to inject malicious code using PHP dynamic callable syntax, bypassing validation and executing arbitrary commands via eval(). The vulnerability is classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code). The CVSS 4.0 base score is 8.6, indicating high severity. No patch or official remediation level has been provided yet, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary PHP code remotely on the affected system. This can lead to full compromise of the Dolibarr ERP/CRM application environment, potentially affecting data integrity, confidentiality, and availability. The vulnerability requires high privileges (administrator) and does not require user interaction. The high CVSS score reflects the critical impact of remote code execution in a widely used ERP/CRM platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to computed extrafields or dynamic code evaluation. Avoid using vulnerable versions of Dolibarr ERP/CRM in untrusted environments. Follow vendor channels closely for updates and apply official patches once available.