CVE-2025-67486: Dolibarr ERP/CRM RCE Vulnerability

CVE-2025-67486 Overview

CVE-2025-67486 is an authenticated remote code execution vulnerability in Dolibarr ERP/CRM, an open-source enterprise resource planning and customer relationship management platform. The flaw affects versions 22.0.2 and earlier and resides in the user extrafields functionality. User-controlled input from the computed value field reaches PHP's eval() function without adequate sanitization. Authenticated administrators can leverage this to execute arbitrary PHP code on the underlying server. At the time of publication, no patched version is available from the vendor.

Critical Impact

Authenticated administrators can achieve full PHP code execution on the Dolibarr host, leading to complete confidentiality, integrity, and availability compromise of the ERP/CRM environment.

Affected Products

• Dolibarr ERP/CRM version 22.0.2
• All Dolibarr ERP/CRM versions prior to 22.0.2
• Self-hosted Dolibarr installations exposing the user extrafields administration interface

Discovery Timeline

• 2026-05-08 - CVE-2025-67486 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-67486

Vulnerability Analysis

The vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). Dolibarr allows administrators to define extrafields for user records, including a computed value attribute that supports dynamic expressions. The application processes these expressions by passing the stored string directly into PHP's eval() function inside htdocs/core/lib/functions.lib.php. Because the input lacks adequate filtering or allow-listing, any valid PHP expression injected into the computed value is executed in the context of the web server process. The attack requires authenticated administrator privileges, but post-exploitation grants full server-side code execution, enabling credential theft, lateral movement, and persistence within the ERP environment.

Root Cause

The root cause is the direct use of eval() on operator-supplied data without sanitization or use of a safe expression evaluator. The computed value field is treated as trusted PHP code rather than as user input subject to validation. Combined with administrative configuration workflows that store arbitrary strings, this design pattern produces a deterministic injection sink.

Attack Vector

An authenticated administrator navigates to the user extrafields configuration interface and creates or edits a custom field with a malicious PHP payload in the computed value attribute. When Dolibarr renders or evaluates the user record that references this extrafield, the payload is passed to eval() and executed on the server. The attack is delivered over the network through normal HTTP requests to the administrative interface and does not require user interaction beyond rendering the affected page. Technical analysis is available in the Medium Remote Code Execution Analysis and the affected source can be reviewed in the Dolibarr functions.lib.php source.

Detection Methods for CVE-2025-67486

Indicators of Compromise

• New or modified entries in the llx_extrafields database table targeting the user element with unusual PHP syntax in the computed value column.
• Unexpected child processes of the PHP-FPM or web server user, such as sh, bash, curl, wget, or python, originating from the Dolibarr application directory.
• Outbound network connections from the Dolibarr host to unknown infrastructure following administrator session activity.
• Web access logs showing POST requests to extrafields administration endpoints followed by anomalous server behavior.

Detection Strategies

• Audit all user extrafield definitions for computed value entries containing function calls such as system, exec, passthru, shell_exec, file_put_contents, or base64_decode.
• Enable PHP application logging and inspect calls into eval() paths from functions.lib.php for runtime evaluation of administrator-controlled strings.
• Monitor administrator account activity, especially recent privilege changes and logins from unfamiliar source addresses.

Monitoring Recommendations

• Forward Dolibarr web server, PHP error, and database audit logs to a centralized analytics platform for correlation.
• Alert on process-creation events where the web server user spawns interactive shells or networking utilities.
• Track changes to administrative configuration tables (llx_extrafields, llx_user) with database triggers or change-data-capture tooling.

How to Mitigate CVE-2025-67486

Immediate Actions Required

• Restrict access to the Dolibarr administrative interface using network controls, VPN, or IP allow-listing until a patch is released.
• Review and reduce the number of accounts holding administrator privileges, and rotate credentials for existing administrators.
• Inspect all existing user extrafields and remove any computed value entries that are not strictly required for business operations.
• Enable multi-factor authentication for all administrative accounts to raise the cost of credential compromise.

Patch Information

As of the publication of CVE-2025-67486, no fixed version is available from Dolibarr. Track the Dolibarr repository for upstream changes to the eval() usage in htdocs/core/lib/functions.lib.php and apply vendor updates as soon as they are released. Customers running version 22.0.2 or earlier should treat the deployment as vulnerable.

Workarounds

• Place the Dolibarr application behind a web application firewall and block requests that submit PHP syntax to extrafields administration endpoints.
• Disable the user extrafields computed value feature in environments where it is not required by removing or disallowing computed fields at the database layer.
• Run the Dolibarr PHP process under a least-privilege operating system account with restricted file system and outbound network permissions to limit post-exploitation impact.

# Configuration example: restrict admin interface access via reverse proxy allow-list
location ~ ^/(htdocs/)?user/(admin|card)\.php {
    allow 10.0.0.0/24;     # trusted admin subnet
    deny  all;
    proxy_pass http://dolibarr_backend;
}