Vulnerabilities

Dolibarr ERP/CRM versions 9.0.0 through 23.0.4 contain a path traversal flaw in the EmailCollector module's attachment handling: the filename taken from an inbound email's MIME headers is passed unsanitized to file_put_contents() in both emailcollector.lib.php and emailcollector.class.php, so traversal sequences survive intact. Any sender who can email a mailbox that an EmailCollector monitors, which is the module's ordinary use for support or ticket inboxes, can trigger the flaw without holding a Dolibarr account. The attacker gains the ability to place attacker-controlled files outside the per-object attachment directory; under the hardened layout (htdocs read-only) the write is confined to the documents tree, where it can corrupt or forge other objects' documents, and where htdocs is writable the write can reach a web-executable path, opening the door to code execution. Installations of Dolibarr 9.0.0 through 23.0.4 running EmailCollector on a mailbox that accepts external mail are affected. No public proof-of-concept, CISA KEV listing, or known exploitation exists, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

Do: Upgrade to Dolibarr 24.0.0 or later, which applies dol_sanitizePathName() and dol_sanitizeFileName() to attachment names before writing. If an immediate upgrade is not possible, restrict which senders can reach the monitored inbox, apply the hardened layout from SECURITY.md (make htdocs read-only) so writes are confined to the documents tree, and audit the documents directory for unexpected or misplaced files.

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.