Dolibarr versions 22.0.2 and earlier allow an authenticated administrator to execute arbitrary PHP code on the server by injecting code into the "computed value" field of user extrafields. The input is directly passed to PHP's eval() function without any sanitization, which classifies the weakness as CWE‑74. The result is that an attacker who has administrative privileges can run any code on the web server, leading to full control of the application, data, and potentially the underlying operating system. The vulnerability is not impacted by network-level exposure; it requires a logged‑in administrator session.

The affected product is Dolibarr ERP/CRM. All releases up to and including 22.0.2 are impacted. No patched versions are available at the time of this reporting.

The vulnerability carries a CVSS score of 8.6, indicating high severity. EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of a patch means that the risk remains unmitigated. The likely attack vector is via the web interface; an authenticated administrator can reach the user extrafields screen and supply malicious input. Because the code path involves eval, the attack can be carried out with any commensurate input size, making exploitation straightforward for an adversary familiar with Dolibarr administration.