In Dolibarr ERP & CRM versions 22.0.4 and earlier, the Website module relies on a blacklist of PHP functions to prevent dangerous operations. An authenticated user granted permission to edit PHP content can sidestep this filtering, allowing execution of arbitrary system commands. This flaw enables a malicious actor to gain full code execution on the host server, compromising confidentiality, integrity, and availability of the entire system.

Dolibarr ERP & CRM (Website module), specifically any installation using version 22.0.4 or earlier.

The vulnerability carries a high severity rating; the CVSS score of 8.8 indicates high severity, and the ability to execute arbitrary commands gives attackers complete control over the underlying operating system. No EPSS score is available, so precise exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog, yet it remains a critical risk for any environment where users can edit PHP files without stringent controls.