Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81730— Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename

Quick assessment

Affected
Dolibarr dolibarr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dolibarr 9.0.0 至 23.0.4 版本在保存入站邮件附件时，直接使用邮件 MIME 头中提供的文件名，而未将其简化为安全的基础文件名。全局函数 （位于 ）会构建路径 并将其传递给 ；而 中的私有函数 则写入 。文件名通过记录关联、创建工单（create-ticket）和创建项目（create-project）等操作，从附件自身的 或 值传入。因此，若文件名中包含路径遍历序列（如 ），该序列将原样保留。这意味着，任何能够向受 EmailCollector 监控的邮箱发送邮件的人（该模块常用于支持或工单收

CVSS 8.2 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81730

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
Source: CVE Program / CVE List V5
Vulnerability Description
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.'/'.$filename; the name reaches both from the attachment's own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module's ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr's SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects' documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Dolibarr dolibarr 9.0.0 ~ 24.0.0 -

II. Public POCs for CVE-2026-81730

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81730

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81730 (1)

Vendor Advisories for CVE-2026-81730 (1)

Vendor Pages for CVE-2026-81730 (1)

Same Patch Batch · Dolibarr · 2026-08-27 · 3 CVEs total

CVE-2026-81728 8.1 HIGH Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
CVE-2026-81729 6.5 MEDIUM Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion

IV. Related Vulnerabilities

Same product: dolibarr
Same vendor: Dolibarr
Same weakness: CWE-22

V. Comments for CVE-2026-81730

No comments yet

Leave a comment