CVE-2026-85401

Dolibarr Legacy File Manager config.inc.php access control

State: Published
Severity: 5.3 Medium
Published: Sep 4, 2026
Updated: Sep 4, 2026
Reserved: Sep 3, 2026

Description

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-284 Improper Access Controls
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
Dolibarrn/a	21.0.0Affected 21.0.1Affected 21.0.2Affected 21.0.3Affected 21.0.4Affected 22.0.0Affected 22.0.1Affected 22.0.2Affected 22.0.3Affected 22.0.4Affected 22.0.5Affected 23.0.0Affected 23.0.1Affected 23.0.2Affected 23.0.3Affected 23.0.4Not affected

References

VDB-398543 | Dolibarr Legacy File Manager config.inc.php access controlvdb-entry
VDB-398543 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-85401 | CVE Analysis and Reportthird-party-advisory
Submit #894869 | Dolibarr -server 21.0/22.0 BROKEN ACCESS CONTROL (STILL UNPATCHED) in File Manager Endpointthird-party-advisory
https://github.com/Dolibarr/dolibarr/issues/38963exploitissue-tracking
https://github.com/Dolibarr/dolibarr/pull/39731issue-trackingpatch
https://github.com/Dolibarr/dolibarr/commit/ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ecpatch
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4patch
https://github.com/Dolibarr/dolibarr/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.