Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe… (CVE-2026-81730)

Dolibarr versions 9.0.0 through 23.0.4 save inbound email attachments using the filename provided in the MIME headers without reducing it to a safe basename. The saveAttachment() functions in the EmailCollector module directly use these filenames, allowing directory traversal sequences to remain intact. Consequently, an attacker who can send email to a mailbox monitored by EmailCollector can write files outside the intended attachment directory without needing a Dolibarr account. Under hardened security layouts with htdocs read-only, writes are confined to the documents tree, affecting document integrity. If htdocs is writable, the vulnerability can lead to placing files in web-executable locations. Dolibarr 24.0.0 mitigates this by applying dol_sanitizePathName() and dol_sanitizeFileName() to filenames before writing.

This vulnerability allows unauthenticated attackers to write files outside the designated attachment directory by exploiting directory traversal in attachment filenames. The impact includes potential corruption or forgery of documents within the documents tree under secure configurations. If the htdocs directory is writable, attackers may place files in web-executable paths, increasing the risk of remote code execution or further compromise. The CVSS score of 8.2 reflects high severity due to the ease of exploitation (network vector, no privileges or user interaction required) and the high integrity impact.

Dolibarr version 24.0.0 includes a fix that sanitizes attachment filenames before saving, preventing directory traversal. Users should upgrade to version 24.0.0 or later to remediate this vulnerability. If upgrading is not immediately possible, ensure that the htdocs directory is set to read-only to limit the impact to the documents tree and prevent writes to web-executable paths. Patch status is not explicitly confirmed beyond the mention of version 24.0.0 applying sanitization functions; check the official Dolibarr advisory for the latest remediation guidance.