CVE-2025-56588
Published: 01 October 2025
Summary
CVE-2025-56588 is a high-severity Code Injection (CWE-94) vulnerability in Dolibarr Dolibarr Erp\/Crm. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Template Injection (T1221); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents code injection (CWE-94) by validating and sanitizing the computed field parameter in the User module configuration.
Mitigates the specific RCE flaw in Dolibarr v21.0.1 through timely identification, testing, and installation of security patches.
Restricts the types and formats of inputs to the computed field parameter, reducing the risk of exploitable code injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE via malicious expressions in computed fields of the User module, evaluated server-side during page rendering, enables Template Injection.
NVD Description
Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.
Deeper analysisAI
CVE-2025-56588 is a remote code execution (RCE) vulnerability affecting Dolibarr ERP & CRM version 21.0.1. The flaw resides in the User module configuration, exploitable through the computed field parameter, and is classified under CWE-94 (Code Injection). It received a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
The vulnerability can be exploited remotely over the network by unauthenticated attackers (PR:N) with low complexity (AC:L), though it requires user interaction (UI:R), such as tricking a user into performing a specific action. Successful exploitation enables arbitrary code execution on the server, granting attackers high-level control over the affected system without changing scope (S:U).
Advisories and further details are available from the vendor at http://dolibarr.com and the research repository at https://github.com/PhDg1410/Research, published on 2025-10-01.
Details
- CWE(s)