https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 20:05:40 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-81730 <p>Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message&#39;s MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . &#39;.&#39; . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.&#39;/&#39;.$filename; the name reaches both from the attachment&#39;s own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module&#39;s ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr&#39;s SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects&#39; documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.</p> <p>Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message&#39;s MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . &#39;.&#39; . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.&#39;/&#39;.$filename; the name reaches both from the attachment&#39;s own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module&#39;s ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr&#39;s SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects&#39; documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-81730 https://vulnerability.circl.lu/vuln/ghsa-jgch-2jr2-87vj <p>Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message&#39;s MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . &#39;.&#39; . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.&#39;/&#39;.$filename; the name reaches both from the attachment&#39;s own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module&#39;s ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr&#39;s SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects&#39; documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.</p> <p>Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message&#39;s MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . &#39;.&#39; . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to $destdir.&#39;/&#39;.$filename; the name reaches both from the attachment&#39;s own getName() or getFilename() value by way of the record-join, create-ticket and create-project operations. A traversal sequence in the filename therefore survives intact, so any sender who can email a mailbox that an EmailCollector monitors, which is the module&#39;s ordinary use for a support or ticket inbox, can place attacker-controlled content outside the per-object attachment directory without holding a Dolibarr account. Under the hardened layout Dolibarr&#39;s SECURITY.md requires, with htdocs read-only, the write is confined to the documents tree and corrupts or forges other objects&#39; documents; where htdocs is writable the same primitive reaches a web-executable path. Version 24.0.0 applies dol_sanitizePathName() and dol_sanitizeFileName() before the write.</p> https://vulnerability.circl.lu/vuln/ghsa-jgch-2jr2-87vj