CVE-2026-85401 in Dolibarr
Summary
by MITRE • 09/04/2026
A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The identified vulnerability resides within Dolibarr, a comprehensive open-source ERP and CRM software suite, specifically affecting versions up through 21.0.4, 22.0.5, and 23.0.3. The flaw is located in the Legacy File Manager component, which has been deprecated but remains present in older installations for backward compatibility. The specific point of failure is within the configuration file htdocs/core/filemanagerdol/connectors/php/config.inc.php. This file serves as a critical interface between the legacy file management system and the underlying PHP execution environment. Due to improper access controls implemented during its development, this component fails to adequately restrict who can modify or interact with sensitive configuration parameters that dictate how files are handled on the server.
The technical nature of this weakness aligns closely with CWE-284, which describes Improper Access Control vulnerabilities where an actor is able to bypass intended restrictions. In this context, the lack of rigorous validation and authorization checks allows a remote attacker to manipulate the configuration settings or exploit the file handling logic without proper authentication or privilege escalation requirements being met. Because the Legacy File Manager processes user-supplied input related to file paths and operations, the improper access control mechanism enables an adversary to perform unauthorized actions such as reading sensitive files outside of designated directories, modifying system configurations, or potentially achieving remote code execution depending on how the underlying server interprets the manipulated inputs.
The operational impact of this vulnerability is significant for any organization still running affected versions of Dolibarr. Since the attack vector is remote and does not require prior authentication in many deployment scenarios involving public-facing instances, it presents a high-risk surface area for exploitation. The fact that an exploit has been made publicly available further exacerbates the threat landscape, as automated scanning tools and malicious actors can readily leverage this weakness to compromise server integrity. Successful exploitation could lead to data exfiltration of confidential business information stored within Dolibarr, unauthorized modification of critical application settings, or complete takeover of the web server hosting the instance if combined with other local vulnerabilities.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK techniques related to Initial Access and Privilege Escalation. Attackers may use this flaw as an entry point into internal networks where Dolibarr is deployed for enterprise resource planning or customer relationship management activities. The persistence of the legacy component suggests that many organizations have not fully migrated away from older architectural patterns, leaving them exposed to known issues that have since been remediated in newer releases.
To mitigate this risk, immediate action is required by upgrading Dolibarr to version 23.0.4 or later, which incorporates the patch identified as ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. This update addresses the improper access controls within the Legacy File Manager component by enforcing stricter validation and authorization checks on configuration interactions. For organizations that cannot immediately upgrade, it is advisable to disable or remove the legacy file manager module if its functionality is not strictly required for business operations. Additionally, implementing web application firewalls with rules specifically targeting known exploit patterns associated with this vulnerability can provide a temporary layer of defense while migration plans are executed. Regular security audits and patch management cycles should be enforced to ensure that deprecated components do not remain active in production environments where they pose unnecessary risk.