CVE-2026-81730

Name of the Vulnerable Software and Affected Versions Dolibarr versions 9.0.0 through 23.0.4

Description The software saves inbound email attachments using the name provided in the message's MIME headers without properly sanitizing it to a safe basename. This occurs within the global saveAttachment() function in htdocs/emailcollector/lib/emailcollector.lib.php, which constructs $filepath using $path, $filename, and $ext before passing it to file put contents(), and the private saveAttachment() function in htdocs/emailcollector/class/emailcollector.class.php, which writes to $destdir using $filename. These values are derived from the attachment's getName() or getFilename() during record-join, create-ticket, and create-project operations.

An attacker can include a traversal sequence in the filename to place controlled content outside the intended attachment directory without requiring an account. If the htdocs directory is read-only, the impact is limited to the documents tree, potentially corrupting or forging other objects' documents. However, if htdocs is writable, the attacker can write files to a web-executable path.

Recommendations Update to version 24.0.0.