An insecure use of call_user_func_array inside Dolibarr’s cronjob handler allows a remote attacker to execute arbitrary PHP code when a cron job is triggered. The flaw resides in htdocs/cron/class/cronjob.class.php and permits injection of arbitrary function calls with user-supplied arguments, resulting in complete compromise of the affected system.

Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and the 24.0.0‑alpha release are susceptible. The vulnerability exists within the core cronjob module of the product, which is normally accessed via web requests or scheduled cron triggers.

The CVSS score and EPSS are not disclosed, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw permits arbitrary code execution from a remote request, the risk is considered high. An attacker would need to exploit an exposed cron job endpoint or invoke the cron scheduler, suggesting a remote attack vector that can be accessed over the network if the application is reachable. No specific exploitation prerequisites are stated in the description, implying that a public-facing instance of Dolibarr could be vulnerable if it accepts cron job requests from untrusted sources.