Dolibarr vulnerable to Eval Injection

CRITICAL 9.8CVE-2022-40871 · BIT-dolibarr-2022-40871 · GHSA-7cm4-vmf2-8wf2 · Published 12/10/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
dolibarr/dolibarr Packagist	`≤ 15.0.3`	No fix yet
dolibarr erp/crm dolibarr	`≤ 15.0.3`	No fix yet

Description

Dolibarr ERP & CRM <=15.0.3 are vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

NVD description

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

References

nvd.nist.gov/vuln/detail/CVE-2022-40871 · ADVISORY
Dolibarr/dolibarr · PACKAGE
youncyb/dolibarr-rce · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free