CVE-2026-85401: Dolibarr Legacy File Manager config.inc.php access control
A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarr Legacy File Managerto a version that resolves this vulnerability.Fixed in 23.0.4Patch ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec
Event History
Frequently Asked Questions
Which deployments are affected?
Dolibarr versions up to 21.0.4, 22.0.5, and 23.0.3 are identified as affected in the Legacy File Manager component, specifically its PHP connector configuration file.
What level of attacker access is required?
The issue can be exploited remotely with low attack complexity, but the supplied severity vector indicates that the attacker needs low-level privileges. No user interaction is required.
Is public exploit code available?
Yes. The vulnerability information states that an exploit has been made publicly available and could be used in attacks.
What should be done to remediate the issue?
Upgrade to Dolibarr version 23.0.4, which is identified as resolving the issue. The associated patch is ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec.