The vulnerability allows an authenticated user with limited permissions in the Dolibarr Website module to inject arbitrary PHP code through unprotected inputs during page creation. Because the permission checks are not applied consistently to all input parameters, the injected PHP can be executed on the server, providing the attacker with full remote code execution capabilities on the affected Dolibarr installation. This leads to a complete compromise of confidentiality, integrity and availability of the underlying web application and any data it manages.

Dolibarr ERP & CRM software versions up to and including 22.0.4 are affected. No other vendor or product information is explicitly listed. Users running earlier or later releases of Dolibarr are not impacted.

The vulnerability’s impact is Remote Code Execution. The CVSS score is 8.8, indicating a high severity level. Exploitation requires only an authenticated Dolibarr account that has access to the Website module and the HTML/JavaScript editing permission; it does not require elevated system privileges. Since no EPSS information or KEV listing is available, the likelihood of exploitation is unknown, but the potential damage is severe. No official patch or workaround is listed.