Dolibarr has Remote Code Execution Vulnerability (Bypass)
Date: 2025-07
Affected: composer/dolibarr/dolibarr
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CWE: CWE-98
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

# Summary The Dolibarr backend provides the function of adding Menu, and supports setting permissions for the added Menu: ![](https://raw.githubusercontent.com/wh0amitx/Misc/main/images/image-20240228164114688.png) This is the trigger point of the vulnerability. The submitted permission can be php code, and it will be executed when viewing the created Menu: - htdocs/admin/menus/edit.php ![](https://raw.githubusercontent.com/wh0amitx/Misc/main/images/image-20240228164445656.png) As you can see, in edit.php, if the created menu is set to `$menu->perms`, the `dol_eval()` method will be called. Following the `dol_eval()` method, we can see that it will filter the dangerous php functions in `$menu->perms` through the blacklist set in `$forbiddenphpfunctions`: ![](https://raw.githubusercontent.com/wh0amitx/Misc/main/images/image-20240228164725548.png) However, the blacklist here is not comprehensive. For example, the `include_once` and `require_once` functions can easily pass the blacklist check, which will cause file inclusion vulnerabilities. Moreover, if the `allow_url_include` option is enabled in php.ini, arbitrary code execution will occur. **The most serious thing is that we can cooperate with the file upload at `/htdocs/user/document.php?id=1&uploadform=1` to achieve more general arbitrary code execution.** # Proof of Concept ## Local File Inclusion (1) First, create a Menu and set "Permissions" to `include_once('/etc/passwd')` (note that `''` must be used here b


Mitigations:

Architectural layers (MAESTRO):