CVE-2026-81730

Dolibarr ERP/CRM versions 9.0.0 through 23.0.4 contain a path traversal flaw in the EmailCollector module's attachment handling: the filename taken from an inbound email's MIME headers is passed unsanitized to file_put_contents() in both emailcollector.lib.php and emailcollector.class.php, so traversal sequences survive intact. Any sender who can email a mailbox that an EmailCollector monitors, which is the module's ordinary use for support or ticket inboxes, can trigger the flaw without holding a Dolibarr account. The attacker gains the ability to place attacker-controlled files outside the per-object attachment directory; under the hardened layout (htdocs read-only) the write is confined to the documents tree, where it can corrupt or forge other objects' documents, and where htdocs is writable the write can reach a web-executable path, opening the door to code execution. Installations of Dolibarr 9.0.0 through 23.0.4 running EmailCollector on a mailbox that accepts external mail are affected. No public proof-of-concept, CISA KEV listing, or known exploitation exists, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Upgrade to Dolibarr 24.0.0 or later, which applies dol_sanitizePathName() and dol_sanitizeFileName() to attachment names before writing. If an immediate upgrade is not possible, restrict which senders can reach the monitored inbox, apply the hardened layout from SECURITY.md (make htdocs read-only) so writes are confined to the documents tree, and audit the documents directory for unexpected or misplaced files.