Critical Dolibarr flaw: computed fields allow code execution

What the security advisory says

The Dolibarr project has published a security advisory rated critical about the dol_eval_standard() function, which evaluates the values of computed extra fields. The sandbox meant to limit what a formula can do is incomplete. An administrator can insert an expression that bypasses the checks and leads to code execution on the server. The CVSS 3.1 score is 9.1. The advisory reports that the attack requires administrator rights, but that the formula runs for every user who opens the affected record. The flaw was found in late March 2026 by a security researcher, credited in the advisory, and then reported to the Dolibarr security team. We deliberately do not describe the method. What matters to you is what to do about it.

Affected versions and fixed version

The advisory confirms the flaw on Dolibarr 23.0.0. It states that it probably affects all versions that use dol_eval_standard() with the default path, the one where the dolibarr_main_restrict_eval_methods parameter is set. The fixed version named is 23.0.3, released on 18 May 2026. Several versions have been released since: 23.0.4 and 24.0.0 on 20 August 2026, then 24.0.1 on 7 September 2026. If you run 23.0.0, 23.0.1 or 23.0.2, you are exposed. For the other branches, the advisory gives no precise list. Check that you are on the latest maintenance release of your branch rather than assuming you are not affected.

Why an administrator-only risk still matters

It is tempting to downplay it: you need to be an administrator. In practice, that requirement is less reassuring than it sounds. An administrator account whose password has leaked, a contractor whose access was never removed, a compromised workstation: any one of them makes the scenario realistic. Once the formula is in place, the advisory stresses that it runs every time the record is viewed, by any user. The consequences described range from code execution to reading server files, including the configuration file that holds the database credentials. For an SME, that means potential access to all customer data, invoices and accounting documents.

Update: the priority measure

The answer is simple: move to a fixed version. If you are on branch 23, version 23.0.4 contains the fix from 23.0.3. If you have already migrated, 24.0.1 is the latest release published to date. Before any operation, back up the database and the documents directory, then test the update on a copy. Our article on the first maintenance release of Dolibarr 24 details what that version brings. If you prefer to delegate, our maintenance service handles security updates, and the DolicraftUpgrade module offers an update with automatic backup for versions 16 to 23.

Check your instance while waiting for the update, or after it

An update closes the door, but it does not tell you whether someone has already walked through it. Take a moment to check what already exists. This review is quick and useful even if you have no particular suspicion.

• List the administrator accounts and delete those that are no longer needed, then change the passwords of the others.
• Open the extra attributes configuration of each module and reread all computed values: any formula nobody recognizes must be examined.
• Search the custom directory for recent files you did not upload, especially with the php extension.
• Check that the web server has no more write permissions than necessary on the application tree.
• Enable stronger authentication for administrators where your configuration allows it.

Reduce the attack surface for the long term

This flaw is a reminder of one principle: administration rights in an ERP are equivalent to access to the server. Limit them to two or three named people, separate daily-work accounts from administration accounts, and remove a contractor's access as soon as the assignment ends. On the infrastructure side, a server that cannot write everywhere in the web directory limits what malicious code could drop. We have gathered these practices in our guide to securing Dolibarr in production. They do not replace the fix, but they reduce the impact of the next flaw, whatever it is.

Your next action

Today, open the information page of your Dolibarr instance and note the version number. If it is 23.0.0, 23.0.1 or 23.0.2, schedule the update this week, without waiting for your usual maintenance window. If you do not have a test environment or the time needed, contact us: we check your version, review your computed fields and carry out the update with a prior backup. The official reference remains the security advisory published by the Dolibarr project, which you can consult to follow any further details.