Dolibarr 9.0.0 through 23.0.4 accepts inbound email attachments and writes them to disk using the filename supplied in the MIME headers without sanitizing any traversal characters. The constructed file path is passed directly to file_put_contents() or written via a private method, so an attacker can embed sequences such as ../../ in the attachment name. The result is that the attachment is stored outside the intended per-object attachment directory, allowing arbitrary file placement and potential overwrite of critical files or upload of executable content. This flaw can lead to disclosure, modification, or execution of system files, effectively compromising the integrity and confidentiality of the system. Affected systems are the Dolibarr ERP/CRM application, specifically all releases from 9.0.0 up to and including 23.0.4. These versions lack the sanitization functions dol_sanitizePathName() and dol_sanitizeFileName() that were introduced in version 24.0.0 to strip traversal sequences and enforce safe basenames. Only the hardened deployment model with a read‑only htdocs mitigates the risk to document-level writes; otherwise the write primitive reaches any writable web path. The risk level is high with a CVSS score of 8.8; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated or low‑privilege attacker sending a crafted email to a mailbox monitored by the EmailCollector module, such as a support or ticket inbox. Given the ease of sending email and absence of input validation, the probability of exploitation is significant in environments where the application is publicly reachable or the mailbox is widely exposed.

Affected systems are the Dolibarr ERP/CRM application from version 9.0.0 through 23.0.4. These releases include the EmailCollector module, which accepts inbound email attachments. The flaw arises because the application writes attachment files using the original filename without sanitization, enabling traversal sequences to escape the per‑object attachment directory and place files anywhere within or outside Dolibarr’s documents tree. Versions 24.0.0 and later include sanitization routines that mitigate this issue.

The risk level is high with a CVSS score of 8.8; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated or low‑privilege attacker sending a crafted email to a mailbox monitored by the EmailCollector module, such as a support or ticket inbox. The absence of input validation and the ease of sending email mean that exploitation is plausible in environments where the application is publicly reachable or the mailbox is widely exposed. Successful exploitation would allow the attacker to write arbitrary files within or outside the Dolibarr documents tree, potentially compromising application integrity, confidentiality, and availability.