An unauthenticated path traversal vulnerability in the Dolibarr EmailCollector module allows remote attackers to write arbitrary files to the server filesystem, potentially leading to remote code execution.

The EmailCollector module fails to sanitize filenames provided in email MIME headers before saving attachments, using an unsanitized input to construct file paths. This allows an unauthenticated attacker to inject traversal sequences, enabling file writes outside of the intended directory.

The vulnerability poses a severe risk to organizational data integrity and system security. Depending on the server configuration, an attacker may be able to overwrite critical application files or place web-executable scripts in accessible directories, resulting in full system compromise. With a CVSS score of 8.2, this flaw is classified as High severity and requires immediate attention to prevent unauthorized access or system takeover.

Immediate Action: Upgrade Dolibarr immediately to version 24.0.0 or later, which implements mandatory filename and path sanitization.

Proactive Monitoring: Review web server logs for suspicious email attachments containing directory traversal characters, such as dot-dot-slash sequences, in the file metadata.

Compensating Controls: If an immediate upgrade is not feasible, restrict the write permissions of the web server user to the absolute minimum required and ensure that the application directory is configured as read-only where possible.

Public Exploit Available: No (exploit_available: false)

Given the potential for remote code execution and the ease of triggering the vulnerability via a simple email, organizations running affected versions of Dolibarr should prioritize this patch. Upgrading to version 24.0.0 is the only reliable method to eliminate the underlying path traversal primitive.