Authenticated code execution via unsanitized computed field

Code injection in Dolibarr ERP & CRM before 19.0.2 allows remote authenticated users to execute commands through a computed user field. Users Module Setup accepts a Computed field expression without adequate sanitization, allowing attacker-controlled syntax to reach formula evaluation as executable code. Administrative access to that setup function is required, and successful exploitation runs code with the web application's privileges.