| शीर्षक | Dolibarr Dolibarr ERP CRM Latest develop branch as of the submission date, confirmed on official Docker image (v23.0.2) Content-Type Override and API Authorization Bypass Leading to Un |
|---|
| विवरण | A vulnerability chain in Dolibarr ERP CRM (up to and including v23.0.2) allows a low-privileged authenticated user to upload arbitrary HTML content to the public medias directory via the REST API, which bypasses the permission checks enforced by the web interface. The file serving endpoint (document.php) accepts user-controlled URL parameters that override the HTTP Content-Type header, causing stored files to be rendered as text/html inline in the browser. The medias directory is served without authentication, and the Content Security Policy omits the form-action directive, allowing HTML forms in the served content to submit data to external destinations without restriction. Combined, these weaknesses enable credential disclosure affecting unauthenticated external users through content served from the trusted application domain. Fixed in v24.0 via commits https://github.com/Dolibarr/dolibarr/commit/022a6c3b519a88df224b21ea02e27e96f2c3c192 and https://github.com/Dolibarr/dolibarr/commit/9f9ffa288d4ad2632c1d5dd88272c699a592f4ec |
|---|
| स्रोत | ⚠️ https://github.com/Dolibarr/dolibarr/commit/9f9ffa288d4ad2632c1d5dd88272c699a592f4ec |
|---|
| उपयोगकर्ता | Mesh3l (UID 101319) |
|---|
| सबमिशन | 18/09/2026 11:13 AM (1 महीना पहले) |
|---|
| संयम | 19/10/2026 04:57 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 422397 [Dolibarr तक 23.0.2 CSP htdocs/document.php अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|