CVE-2026-81730

Received Received - Intake

Path Traversal in Dolibarr Email Attachments

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.'/'.$filename; the name reaches both from the attachment's own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module's ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr's SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects' documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-81730

Affected Vendors & Products

Vendor	Product	Version / Range
dolibarr	dolibarr	From 9.0.0 (inc) to 23.0.4 (inc)
dolibarr	dolibarr	24.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in Dolibarr versions 9.0.0 through 23.0.4 affecting the EmailCollector module. Attackers can send emails with malicious filenames containing path traversal sequences to a monitored mailbox. The system saves attachments using the raw filename from email headers without sanitization, allowing writes outside the intended directory. Version 24.0.0 fixes this by sanitizing filenames before saving.

Detection Guidance

Check Dolibarr versions between 9.0.0 and 23.0.4. Review email attachments saved by the EmailCollector module for unusual filenames or paths. Inspect logs for file writes outside expected directories. Use commands like grep to search for path traversal patterns in filenames.

Impact Analysis

An attacker could overwrite or corrupt files in the documents tree, forge documents, or place malicious files in web-executable paths if htdocs is writable. Exploitation requires only sending an email to a monitored mailbox; no Dolibarr account is needed. The impact ranges from data integrity issues to potential remote code execution depending on system configuration.

Compliance Impact

This vulnerability could lead to unauthorized file modifications or data breaches, violating integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized document changes may compromise audit trails or protected health information, potentially resulting in compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade Dolibarr to version 24.0.0 or later. Disable the EmailCollector module if not needed. Implement strict file permission checks on htdocs and document directories. Monitor for unexpected file writes or modifications.

Hi! I’m here to help you understand CVE-2026-81730. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70