4 matches found
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it ...
CVE-2026-81730 Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it ...
CVE-2026-81730 Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it ...
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 is vulnerable to path traversal in its EmailCollector module. The saveAttachment() functions in emailcollector.lib.php and emailcollector.class.php write inbound email attachments using the MIME-supplied filename without reducing it to a safe basename, allowing trave...