CVE-2025-56588: Dolibarr ERP/CRM RCE Vulnerability

CVE-2025-56588 Overview

CVE-2025-56588 is a remote code execution vulnerability in Dolibarr ERP & CRM version 21.0.1. The flaw exists in the User module configuration and is triggered through the computed field parameter. An authenticated attacker with access to the User module configuration can inject server-side code that the application evaluates during rendering. Successful exploitation grants execution in the context of the web application, exposing business data and the underlying host. The weakness is classified under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Attackers can execute arbitrary code on Dolibarr ERP & CRM servers, leading to full compromise of confidentiality, integrity, and availability of business records.

Affected Products

Dolibarr ERP & CRM v21.0.1
Dolibarr User module configuration component
Deployments exposing the computed field parameter to authenticated users

Discovery Timeline

2025-10-01 - CVE-2025-56588 published to NVD
2025-10-22 - Last updated in NVD database

Technical Details for CVE-2025-56588

Vulnerability Analysis

Dolibarr supports computed fields, which let administrators define expressions evaluated at runtime to derive values for object attributes. In version 21.0.1, the User module accepts attacker-controlled input for the computed field parameter without sufficient validation. The application passes that expression to a server-side evaluator, which interprets it as executable code. Because no allow-list constrains the expression syntax, an attacker can supply arbitrary PHP-level constructs that run when the User record is loaded or rendered.

The vulnerability requires user interaction, indicating an authenticated path through the configuration interface. Once the malicious expression is stored, every subsequent access of an affected User record triggers code execution. This persistence makes the issue useful for both initial compromise and post-exploitation persistence on internal ERP deployments.

Root Cause

The root cause is unsafe evaluation of user-supplied expressions in the computed field handler within the User module. Dolibarr trusts the stored expression and dispatches it to a dynamic code execution path rather than to a sandboxed expression parser. The control gap maps directly to [CWE-94].

Attack Vector

An attacker authenticates to Dolibarr with privileges sufficient to modify User module configuration. They submit a crafted computed field expression containing server-side code. When a privileged user views or processes affected User entities, the expression executes, returning code execution in the context of the Dolibarr web process.

The vulnerability is described in the public research repository. See the GitHub Research Repository for technical details and proof-of-concept material.

Detection Methods for CVE-2025-56588

Indicators of Compromise

Unexpected modifications to computed field definitions in llx_extrafields or related User module tables.
PHP processes spawning shells, curl, wget, or compilers from the Dolibarr web root.
New administrative accounts or privilege changes within Dolibarr audit logs after configuration edits.
Outbound connections from the Dolibarr server to unfamiliar hosts following User record access.

Detection Strategies

Inspect Dolibarr database backups for computed field expressions containing PHP keywords such as system, exec, passthru, eval, or base64_decode.
Review web server access logs for POST requests to User module configuration endpoints from non-administrative source addresses.
Correlate web request telemetry with child process creation on the Dolibarr host to surface code execution attempts.

Monitoring Recommendations

Enable file integrity monitoring on the Dolibarr installation directory and configuration tables.
Forward web server, PHP-FPM, and host process telemetry to a centralized analytics platform for behavioral correlation.
Alert on PHP worker processes spawning command interpreters, a pattern aligned with code injection exploitation.

How to Mitigate CVE-2025-56588

Immediate Actions Required

Restrict access to the User module configuration interface to a minimal set of administrators.
Audit existing computed field definitions and remove any expressions referencing system or process functions.
Place Dolibarr behind authenticated reverse proxies and limit network exposure of administrative endpoints.
Rotate credentials and session tokens if suspicious computed field changes are identified.

Patch Information

No fixed version is referenced in the published NVD record at the time of writing. Monitor the Dolibarr Official Website and the GitHub Research Repository for upstream patches and advisory updates. Upgrade to a release that explicitly addresses CVE-2025-56588 as soon as it becomes available.

Workarounds

Disable the computed field feature in the User module if it is not required for business workflows.
Apply web application firewall rules that block expression syntax in computed field POST parameters.
Run the Dolibarr PHP process under a least-privilege account with restricted filesystem and network capabilities.
Enforce multi-factor authentication for administrative Dolibarr accounts to reduce abuse of the authenticated attack path.

bash

# Example WAF rule sketch (ModSecurity) blocking dangerous tokens in computed field input
SecRule ARGS_NAMES "@rx computed" \
    "id:1056588,phase:2,deny,log,status:403,\
     msg:'Possible CVE-2025-56588 computed field injection',\
     chain"
  SecRule ARGS "@rx (?i)(system|exec|passthru|shell_exec|eval|base64_decode|proc_open)\s*\("