Dolibarr ERP & CRM versions 22.0.4 and below contain a vulnerability in the Website module where blacklist-based filtering of dangerous PHP functions is insufficient. An authenticated user authorized to edit PHP content can bypass these restrictions, resulting in the ability to execute arbitrary system commands remotely. This vulnerability enables full remote code execution on the affected server.

Successful exploitation allows an authenticated user with PHP content editing permissions to execute arbitrary operating system commands on the server, potentially compromising the entire system. This could lead to unauthorized access, data theft, or further system compromise depending on the attacker's objectives and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict PHP content editing permissions to trusted users only and monitor for suspicious activity related to PHP content editing. Avoid granting unnecessary permissions that could enable exploitation.