Dolibarr ERP CVE-2026-81730

The EmailCollector module must be enabled and configured with at least one active collector pointing to a real mailbox - this is the module's ordinary operational mode for support or ticket inboxes, so it is not a non-default or unusual configuration. The attacker must be able to send email to that monitored mailbox address; because such inboxes are typically public-facing (support@, tickets@), this is achievable by any internet sender without authentication or a Dolibarr account. Worst-case impact (web shell planting leading to RCE) additionally requires that the Dolibarr htdocs directory be writable by the web-server process - a configuration that Dolibarr's SECURITY.md explicitly flags as hardening-required but which is common in shared-hosting and quick-deployment scenarios. On hardened deployments where htdocs is read-only, exploitation is limited to writing attacker-controlled content into the Dolibarr documents tree, enabling document corruption or forgery for any object whose attachment directory is reachable via traversal. No special protocol, feature flag beyond EmailCollector being active, or authenticated session is required.

The CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L) accurately reflects the network-reachable, zero-privilege, low-complexity nature of this flaw: any party who can send email to a monitored mailbox - including anonymous internet senders - can trigger the write. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, so widespread automated exploitation has not been confirmed; however, the lack of any authentication barrier and the ubiquity of support-inbox configurations mean the practical exploitation bar is very low. The CVSS integrity impact is rated High but no confidentiality impact is noted (VC:N), consistent with this being a write-only primitive in the base case. The severity bifurcates sharply based on server configuration: on hardened deployments the impact is document corruption and object forgery within Dolibarr's documents tree, serious but contained; on installations where htdocs is writable - a configuration Dolibarr's own SECURITY.md warns against but which exists in practice on many shared-hosting and quickly-deployed instances - the same path traversal becomes a direct route to planting a PHP web shell, escalating effective impact to full remote code execution. Even a mid-sized municipal IT team in tczew should treat this as urgent if EmailCollector is enabled and the Dolibarr htdocs directory is writable by the web process.

An attacker who knows or discovers that a target organization uses Dolibarr's EmailCollector to ingest support requests sends a crafted email to the monitored inbox with an attachment whose MIME filename contains a path traversal sequence, for example '../../htdocs/shell.php'. When EmailCollector processes the message, the unsanitized filename is concatenated into the write path, and file_put_contents() deposits the attacker's PHP content into htdocs/shell.php. The attacker then issues an HTTP request to the planted script to execute arbitrary OS commands as the web-server user. No public exploit code has been identified at time of analysis, but the technique is straightforward for any attacker familiar with PHP path traversal patterns.