An attacker can trigger arbitrary code execution by sending a crafted request to Dolibarr’s core actions file htdocs/core/actions_addupdatedelete.inc.php. This file is included by the ERP/CRM when certain administrative actions are performed, and the vulnerable code allows injection of executable PHP, giving the attacker full control over the affected server.

Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and the 24.0.0-alpha releases are susceptible. The vulnerability resides in the core actions module included by the web application.

No EPSS score is available, and the flaw is not listed in CISA KEV. However, evidence from the description indicates that the likely attack vector involves sending an unauthenticated HTTP request to a publicly accessible PHP script. The lack of mitigating controls means that a successful exploit results in complete compromise of confidentiality, integrity, and availability of the affected system.