Produit : Dolibarr
Type : Security Advisory
Criticité : critical
Date source : 21/10/2026 01:09
Résumé :
# Remote Code Execution via dol_eval sandbox bypass in computed extrafields
## Summary
A sandbox bypass in `dol_eval_standard()` allows an authenticated administrator to achieve Remote Code Execution (RCE) by creating a malicious computed extrafield. The sandbox's whitelist path fails to block arbitrary class instantiation, callable array invocations, and SQLite-based PHP file creation, resulting in a full eval-to-RCE chain.
## Severity
**Critical — CVSS 3.1: 9.1** (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Although the attack requires admin privileges to set up the computed field, the eval executes in the context of **every user** who views the affected record. A compromised or malicious admin achieves persistent RCE affecting the entire server, with potential for lateral movement via credential theft.
## Affected Versions
– Dolibarr **23.0.0** (confirmed)
– Likely all
Action recommandée :
Vérifier la version installée et appliquer le correctif si le produit est concerné.
Source : Voir l’annonce officielle