CVE-2026-81730
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Dolibarr versions 9.0.0 through 23.0.4 save inbound email attachments under the name supplied in MIME headers without reducing it to a safe basename. The saveAttachment() functions in htdocs/emailcollector/lib/emailcollector.lib.php and htdocs/emailcollector/class/emailcollector.class.php build the file path from the attachment name, which may contain path traversal sequences, allowing writes outside the target directory.
Risk Assessment
A sender emailing a monitored mailbox can place malicious files outside the attachment directory, potentially corrupting or forging other objects' documents, and if htdocs is writable, achieving code execution in a web-accessible path.
Recommendation
Upgrade to version 24.0.0, which applies dol_sanitizePathName() and dol_sanitizeFileName() before writing files.
Other vulnerabilities in Dolibarr
See all- CVE-2023-33568High
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
- CVE-2017-14242Critical
CVE-2017-14242 is an SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 that allows remote attackers to execute arbitrary SQL commands via the statut parameter.
- CVE-2026-112361Medium
Dolibarr up to 23.0.2 contains a vulnerability in an unknown function of htdocs/document.php in the CSP component. Manipulation leads to protection mechanism failure, and the attack can be executed remotely.
- CVE-2026-110874Medium
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. An attacker able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.
- CVE-2026-89013High
Dolibarr versions 23.0.4 before 24.0.1 contain an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files by supplying a crafted hashp parameter value. Attackers can use hashp=shared to skip token validation and access logs, business documents, database backups, and files belonging to other entities.
- CVE-2026-89012Medium
Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter. An authenticated attacker can recover protected database fields by supplying uppercase variants of denylist-protected field names, exploiting the mismatch between case-insensitive database column resolution and the case-sensitive denylist check.
- CVE-2026-85401Medium
A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3 in the Legacy File Manager component, specifically in the file htdocs/core/filemanagerdol/connectors/php/config.inc.php. Manipulation leads to improper access controls. The attack can be launched remotely. The exploit is public. Upgrading to version 23.0.4 resolves the issue.
- CVE-2026-82633Medium
Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.
- CVE-2026-81729Medium
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() calls dol_check_secure_access_document() with mode 'read' instead of 'write', allowing an authenticated user with only read permissions to permanently delete module documents.
- CVE-2026-81728High
Dolibarr before 24.0.0 contains a SQL injection vulnerability in its CSV and XLSX import wizard. The wizard reads update keys via GETPOST('updatekeys', 'array') in htdocs/imports/import.php, applying only the generic alphanohtml filter that leaves SQL keywords, comment markers, parentheses, spaces, and quotes intact. The import_insert() function in htdocs/core/modules/import/import_csv.modules.php builds a filter with $where[] = $key.' = '.$data[$key] and executes it via $this->db->query(), allowing SQL injection.
Original NVD description (English source)
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.'/'.$filename; the name reaches both from the attachment's own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module's ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr's SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects' documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS