Description

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-04T03:17:46.677Z",
  "pubdate": "2026-09-04T03:17:46.677Z",
  "executiveSummary": "A critical vulnerability categorized as an improper access control issue exists within the Legacy File Manager component of Dolibarr.\nThis security flaw affects Dolibarr versions up to 21.0.4, 22.0.5, and 23.0.3.\nThe vulnerability allows remote attackers to bypass security restrictions, potentially leading to unauthorized access or manipulation of file system resources managed by the legacy module.\nGiven that proof-of-concept exploit code is publicly available, the risk to unpatched systems is elevated, necessitating immediate attention.\nSuccessful exploitation does not require prior local system access, as the attack vector is remotely reachable via the web interface.\nOrganizations using the affected versions are at risk of unauthorized data exposure or administrative configuration manipulation through the exposed file management connector.\nThe primary mitigation is to apply the provided vendor patch or upgrade to version 23.0.4, which addresses the flaw identified by commit ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec.",
  "technicalDetails": "The vulnerability resides within the file htdocs/core/filemanagerdol/connectors/php/config.inc.php, which serves as a configuration handler for the Legacy File Manager module in Dolibarr.\nThe root cause is an inadequate implementation of authorization checks or access control logic within the connector's configuration script. This allows an unauthenticated or improperly authorized remote user to interact with the file management backend in ways not intended by the application's security policy.\nThe attack flow involves a remote attacker crafting specific requests targeting the connector endpoint. Because the configuration file lacks sufficient validation of the request's origin or the user's session context, the server fails to enforce strict access control policies. This enables the attacker to manipulate the file manager's operation, potentially bypassing intended constraints on file navigation, retrieval, or modification.\nThe vulnerability is exposed through the network-facing web server handling the Dolibarr installation. As the connector resides in the core file path of the Legacy File Manager, requests directed at this directory are processed by the vulnerable configuration script without appropriate authentication or privilege gating.\nIn a typical exploit scenario, an attacker leverages publicly available exploit methodologies to interact with the file manager's API or connector interface. By submitting malicious parameters through the web request, the attacker triggers the insecure code path in config.inc.php. The lack of granular permission checks allows the attacker to circumvent the application's standard security boundary.\nThe impact of this vulnerability is significant, as it grants unauthorized actors the ability to abuse the functionality of the Legacy File Manager. Depending on the specific configuration and environment, this could lead to unauthorized file listing, arbitrary file access, or the potential manipulation of sensitive data managed by the application. The public availability of the exploit code significantly reduces the barrier to entry for potential threat actors, increasing the urgency of the remediation.\nThe remediation, identified by commit ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec, specifically targets the logic within the connector to ensure that all requests are subjected to appropriate authentication and authorization checks before executing any file-related operations."
}