CVE-2026-81730
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Dolibarr versions 9.0.0 through 23.0.4 save inbound email attachments under the name supplied in MIME headers without reducing it to a safe basename. The saveAttachment() functions in htdocs/emailcollector/lib/emailcollector.lib.php and htdocs/emailcollector/class/emailcollector.class.php build the file path from the attachment name, which may contain path traversal sequences, allowing writes outside the target directory.
Risk Assessment
A sender emailing a monitored mailbox can place malicious files outside the attachment directory, potentially corrupting or forging other objects' documents, and if htdocs is writable, achieving code execution in a web-accessible path.
Recommendation
Upgrade to version 24.0.0, which applies dol_sanitizePathName() and dol_sanitizeFileName() before writing files.
Original NVD description (English source)
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.'/'.$filename; the name reaches both from the attachment's own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module's ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr's SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects' documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.