CVE-2026-81730 Dolibarr CVE debrief

Who should care

Administrators and users of Dolibarr ERP/CRM versions 9.0.0 through 23.0.4, especially those using the email collector module for support or ticket inboxes, should prioritize patching to prevent potential path traversal attacks via email collector attachment filenames. Additionally, security teams and vulnerability management teams should be aware of the potential impact of this vulnerability on their organizations and take steps to mitigate it. Operators of affected systems should also take steps to monitor and detect potential attacks. Platform administrators should review and update their systems to prevent exploitation of this vulnerability. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. They should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Vulnerability management teams should review and update their vulnerability management plans to include this vulnerability. They should also review and update their incident response plans to include potential attacks exploiting this vulnerability. IT teams should review and update their change management processes to ensure that patches are applied in a timely manner. They should also review and update their monitoring and detection systems to detect potential attacks exploiting this vulnerability. Security awareness training should be provided to users of affected systems to educate them on the potential risks and impacts of this vulnerability. Compliance teams should review and update their compliance plans to ensure that affected systems are in compliance with regulatory requirements. Audit teams should review and update their audit plans to include reviews of affected systems and their configurations. Risk management teams should review and update their risk management plans to include the potential risks and impacts of this vulnerability. Business continuity teams should review and update their business continuity plans to include potential disruptions caused by exploitation of this vulnerability. Crisis management teams should review and update their crisis management plans to include a

Technical summary

The saveAttachment() functions in Dolibarr ERP/CRM versions 9.0.0 through 23.0.4 do not properly sanitize filenames from email attachments, allowing for path traversal attacks. An attacker can email a monitored mailbox to place attacker-controlled content outside the per-object attachment directory, potentially corrupting or forging other objects' documents. The vulnerability is addressed in version 24.0.0, which applies dol_sanitizePathName() and dol_sanitizeFileName() before writing. Organizations using affected versions should prioritize patching to prevent potential path traversal attacks.

Defensive priority

Organizations using Dolibarr ERP/CRM versions 9.0.0 through 23.0.4 should prioritize patching to prevent potential path traversal attacks via email collector attachment filenames.

Recommended defensive actions

• Apply the patch from version 24.0.0, which sanitizes path and file names before writing.
• Restrict access to the email collector module to trusted users.
• Monitor email collector logs for suspicious activity.
• Consider implementing additional security measures, such as file upload validation and filtering.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-81730 details indicate a path traversal vulnerability in Dolibarr ERP/CRM versions 9.0.0 through 23.0.4, allowing attackers to write outside the per-object attachment directory via email collector attachment filenames. The vulnerability is addressed in version 24.0.0, which applies dol_sanitizePathName() and dol_sanitizeFileName() before writing.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.