CVE-2026-81730
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Dolibarr versions 9.0.0 through 23.0.4 save inbound email attachments under the name supplied in MIME headers without reducing it to a safe basename. The saveAttachment() functions in htdocs/emailcollector/lib/emailcollector.lib.php and htdocs/emailcollector/class/emailcollector.class.php build the file path from the attachment name, which may contain path traversal sequences, allowing writes outside the target directory.
Risk Assessment
A sender emailing a monitored mailbox can place malicious files outside the attachment directory, potentially corrupting or forging other objects' documents, and if htdocs is writable, achieving code execution in a web-accessible path.
Recommendation
Upgrade to version 24.0.0, which applies dol_sanitizePathName() and dol_sanitizeFileName() before writing files.
Other vulnerabilities in Dolibarr
See all- CVE-2023-33568High
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
- CVE-2017-14242Critical
CVE-2017-14242 is an SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 that allows remote attackers to execute arbitrary SQL commands via the statut parameter.
- CVE-2026-89013High
Dolibarr versions 23.0.4 before 24.0.1 contain an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files by supplying a crafted hashp parameter value. Attackers can use hashp=shared to skip token validation and access logs, business documents, database backups, and files belonging to other entities.
- CVE-2026-89012Medium
Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter. An authenticated attacker can recover protected database fields by supplying uppercase variants of denylist-protected field names, exploiting the mismatch between case-insensitive database column resolution and the case-sensitive denylist check.
- CVE-2026-85401Medium
A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3 in the Legacy File Manager component, specifically in the file htdocs/core/filemanagerdol/connectors/php/config.inc.php. Manipulation leads to improper access controls. The attack can be launched remotely. The exploit is public. Upgrading to version 23.0.4 resolves the issue.
- CVE-2026-82633Medium
Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.
- CVE-2026-81729Medium
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() calls dol_check_secure_access_document() with mode 'read' instead of 'write', allowing an authenticated user with only read permissions to permanently delete module documents.
- CVE-2026-81728High
Dolibarr before 24.0.0 contains a SQL injection vulnerability in its CSV and XLSX import wizard. The wizard reads update keys via GETPOST('updatekeys', 'array') in htdocs/imports/import.php, applying only the generic alphanohtml filter that leaves SQL keywords, comment markers, parentheses, spaces, and quotes intact. The import_insert() function in htdocs/core/modules/import/import_csv.modules.php builds a filter with $where[] = $key.' = '.$data[$key] and executes it via $this->db->query(), allowing SQL injection.
- CVE-2026-77923Medium
Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.
- CVE-2026-71511Medium
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API. Authenticated attackers with member-read rights can retrieve bcrypt password verifiers by querying member endpoints. The verifier fields are not filtered by the base API serializer or the Members API class, enabling offline password cracking.
Original NVD description (English source)
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.'/'.$filename; the name reaches both from the attachment's own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module's ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr's SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects' documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS