CVE-2025-67486 Dolibarr CVE debrief

Who should care

Defenders responsible for Dolibarr ERP/CRM systems, particularly those with internet-exposed instances or administrators with access to the vulnerable functionality, should assess exposure and prioritize verifying compensating controls.

Why it matters

CVE-2025-67486 is a high-severity vulnerability in Dolibarr ERP/CRM that allows authenticated administrators to execute arbitrary PHP code on the server. Defenders should prioritize verifying exposure, assessing compensating controls, and monitoring for suspicious activity until patches are released.

• Authenticated administrators can execute arbitrary PHP code on the server, potentially leading to system compromise.
• The vulnerability can be exploited remotely, and no patches are currently available.
• Defenders need to verify exposure and assess the need for compensating controls.
• Inventory checks and monitoring for suspicious activity are necessary until patches are released.

Technical summary

The vulnerability exists in the user extrafields functionality of Dolibarr ERP/CRM versions 22.0.2 and earlier. User-controlled input from the 'computed value' field is passed to PHP's `eval()` function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. This can lead to system compromise and potentially allow attackers to gain elevated privileges. Defenders should prioritize verifying exposure and assessing the need for compensating controls, given the lack of available patches. The vulnerability can be exploited remotely, and no patches are currently available. It is essential to review the system's user extrafields configuration and consider to

Defensive priority

Defenders should prioritize verifying exposure and assessing the need for compensating controls, given the lack of available patches.

Recommended defensive actions

• Verify if the Dolibarr ERP/CRM system is exposed to the internet and if administrators have access to the vulnerable functionality.
• Assess the need for compensating controls, such as restricting access to the vulnerable functionality or monitoring for suspicious activity.
• Review the system's user extrafields configuration and consider disabling or restricting access to the 'computed value' field.
• Consider implementing additional security measures, such as input validation and sanitization, to prevent similar vulnerabilities.
• Monitor for suspicious activity and review logs for potential exploitation attempts.
• Perform regular inventory checks to ensure that all instances of Dolibarr ERP/CRM are accounted for and up-to-date.
• Consider implementing a rollback or change window to ensure that any changes to the system are properly tested and validated.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in versions 22.0.2 and earlier of Dolibarr ERP/CRM. However, information on patched versions or workarounds is not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.