| Title | Dolibarr Dolibarr ERP CRM Latest develop branch as of the submission date, confirmed on official Docker image (v23.0.2) Content-Type Override and API Authorization Bypass Leading to Un |
|---|
| Description | A vulnerability chain in Dolibarr ERP CRM (up to and including v23.0.2) allows a low-privileged authenticated user to upload arbitrary HTML content to the public medias directory via the REST API, which bypasses the permission checks enforced by the web interface. The file serving endpoint (document.php) accepts user-controlled URL parameters that override the HTTP Content-Type header, causing stored files to be rendered as text/html inline in the browser. The medias directory is served without authentication, and the Content Security Policy omits the form-action directive, allowing HTML forms in the served content to submit data to external destinations without restriction. Combined, these weaknesses enable credential disclosure affecting unauthenticated external users through content served from the trusted application domain. Fixed in v24.0 via commits https://github.com/Dolibarr/dolibarr/commit/022a6c3b519a88df224b21ea02e27e96f2c3c192 and https://github.com/Dolibarr/dolibarr/commit/9f9ffa288d4ad2632c1d5dd88272c699a592f4ec |
|---|
| Source | ⚠️ https://github.com/Dolibarr/dolibarr/commit/9f9ffa288d4ad2632c1d5dd88272c699a592f4ec |
|---|
| User | Mesh3l (UID 101319) |
|---|
| Submission | 09/18/2026 11:13 (1 month ago) |
|---|
| Moderation | 10/19/2026 16:57 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422397 [Dolibarr up to 23.0.2 CSP htdocs/document.php protection mechanism] |
|---|
| Points | 20 |
|---|