What is GHSA-7cm4-vmf2-8wf2?

GHSA-7cm4-vmf2-8wf2 is a security advisory published by GitHub Security Advisories with Critical severity. Dolibarr vulnerable to Eval Injection

Which CVE IDs does GHSA-7cm4-vmf2-8wf2 cover?

GHSA-7cm4-vmf2-8wf2 covers the following CVE IDs: CVE-2022-40871. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7cm4-vmf2-8wf2?

GHSA-7cm4-vmf2-8wf2 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-7cm4-vmf2-8wf2?

GHSA-7cm4-vmf2-8wf2 affects 1 product, including: composer/dolibarr/dolibarr:\u003c= 15.0.3.

GHSA-7cm4-vmf2-8wf2CriticalCVSS 9.8

Dolibarr vulnerable to Eval Injection

Vendor

GitHub Security Advisories

Published

October 12, 2022

Last Modified

May 15, 2025

🔗 CVE IDs covered (1)

CVE-2022-40871 →

📋 Description

Dolibarr ERP & CRM <=15.0.3 are vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

🎯 Affected products1

composer/dolibarr/dolibarr:<= 15.0.3

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-40871
https://github.com/youncyb/dolibarr-rce
https://github.com/advisories/GHSA-7cm4-vmf2-8wf2