This vulnerability in Dolibarr ERP/CRM affects versions 22.0.0 to 22.0.4 and 24.0.0-alpha. It arises from the use of call_user_func_array() in the cronjob.class.php file, which can be manipulated by a remote attacker to execute arbitrary code. The CVSS score is 7.3, indicating a high severity with network attack vector, no privileges required, and no user interaction needed. The weakness corresponds to CWE-94 (Improper Control of Generation of Code). There is no vendor advisory or patch information available at this time.

Successful exploitation could allow a remote attacker to execute arbitrary code on the affected system, potentially leading to confidentiality, integrity, and availability impacts. The CVSS vector indicates that the attack can be performed remotely without authentication or user interaction, increasing the risk. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected service and monitor for unusual activity related to cronjob execution. Avoid exposing the affected versions publicly if possible.