{"apiVersion":"1.0","identifier":"CVE-2026-81730","description":"Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message-s MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . -.- . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.-/-.$filename; the name reaches both from the attachment-s own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module-s ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr-s SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects- documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.","publishedAt":"2026-08-27T20:18:55","lastModifiedAt":"2026-08-27T20:18:55","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81730","cvssScore":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","epssProbability":0.00376,"riskScore":0.85,"affectedProduct":"Dolibarr","affectedVersions":">=9.0.0,<24.0.0","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-81730","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-81730","en":"https://www.redsauce.net/en/cves/CVE-2026-81730","fr":"https://www.redsauce.net/fr/cves/CVE-2026-81730","pt":"https://www.redsauce.net/pt/cves/CVE-2026-81730","de":"https://www.redsauce.net/de/cves/CVE-2026-81730","sk":"https://www.redsauce.net/sk/cves/CVE-2026-81730","el":"https://www.redsauce.net/el/cves/CVE-2026-81730"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-81730"}}