CVE-2026-81730 - Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
Brief
CVE ID : CVE-2026-81730
Published : Aug. 27, 2026, 8:18 p. m.
- 55 minutes ago
Description : Dolibarr 9.
- 0 through 23.
- 4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector. lib. php builds $filepath = $path . $filename . ' ' .
$ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector. class. php writes to $destdir.' /'. $filename; the name reaches both from the attachment's own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations.