Remote Code Execution in Dolibarr ERP/CRM

Publication date: 2026-05-27

Last updated on: 2026-05-28

Assigner: MITRE

Description

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/cron/class/cronjob.class.php, call_user_func_array() in function job type

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-05-28

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-37712

Affected Vendors & Products

Vendor	Product	Version / Range
dolibarr	dolibarr	From 22.0.0 (inc) to 22.0.4 (inc)
dolibarr	dolibarr	24.0.0-alpha

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Mitigation Strategies

The vulnerability in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha allows remote code execution via the cronjob.class.php file. Although no direct mitigation commands are provided, the recommended fix is to remove the vulnerable call to call_user_func_array() in the affected function and replace it with a safer server-side evaluation mechanism.

Executive Summary

This vulnerability exists in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and version 24.0.0-alpha. It allows a remote attacker to execute arbitrary code by exploiting the call_user_func_array() function within the job type function in the file htdocs/cron/class/cronjob.class.php.

Impact Analysis

The vulnerability can allow a remote attacker to execute arbitrary code on the affected system. This could lead to unauthorized control over the system, potentially resulting in data theft, data loss, system disruption, or further compromise of the network.

Hi! I’m here to help you understand CVE-2026-37712. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70