Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.
References
| Link | Resource |
|---|---|
| http://dolibarr.com | Not Applicable |
| https://github.com/PhDg1410/Research | Patch Third Party Advisory |
Configurations
History
22 Oct 2025, 15:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Dolibarr dolibarr Erp\/crm
Dolibarr |
|
| References | () http://dolibarr.com - Not Applicable | |
| References | () https://github.com/PhDg1410/Research - Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:dolibarr:dolibarr_erp\/crm:21.0.1:*:*:*:*:*:*:* |
01 Oct 2025, 20:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-01 20:18
Updated : 2025-10-22 15:56
NVD link : CVE-2025-56588
Mitre link : CVE-2025-56588
CVE.ORG link : CVE-2025-56588
JSON object : View
Products Affected
dolibarr
- dolibarr_erp\/crm
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')