PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-37713 Dolibarr CVE debrief

A remote code execution vulnerability exists in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and version 24.0.0-alpha. The vulnerability is located in htdocs/core/class/commonobject.class.php and allows a remote attacker to execute arbitrary code. The CVE was published on 2026-05-27 and subsequently modified the same day. The vulnerability status is currently marked as Deferred in the NVD. Two source references are available: a security research blog post and a GitHub Security Advisory. No CVSS score or severity rating has been assigned. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Dolibarr
Product
Dolibarr ERP/CRM
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-28
Advisory published
2026-05-27
Advisory updated
2026-05-28

Who should care

Organizations running Dolibarr ERP/CRM versions 22.0.0-22.0.4 or 24.0.0-alpha; security teams managing open-source business applications; Dolibarr hosting providers

Technical summary

The vulnerability resides in the commonobject.class.php file within Dolibarr's core class library. Affected versions include the 22.0.x stable branch (22.0.0 through 22.0.4) and the 24.0.0-alpha development release. The flaw enables remote attackers to execute arbitrary code. The exact technical mechanism is not detailed in available sources; defenders should monitor the GitHub Security Advisory for technical details and remediation guidance.

Defensive priority

high

Recommended defensive actions

  • Review Dolibarr ERP/CRM installations for versions 22.0.0-22.0.4 and 24.0.0-alpha
  • Monitor GitHub Security Advisory GHSA-cq92-jp5j-rwvj for patch availability
  • Apply security updates when released by the Dolibarr project
  • Restrict network access to Dolibarr administrative interfaces pending patch
  • Review access logs for suspicious activity targeting commonobject.class.php

Evidence notes

Vulnerability affects Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha. Attack vector is remote code execution via htdocs/core/class/commonobject.class.php. Source references include a GitHub Security Advisory (GHSA-cq92-jp5j-rwvj) and a security research publication. NVD status is Deferred; no CVSS vector or weaknesses are currently populated.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-37713 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-37713

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-37713 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-37713

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.