Dolibarr Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerabili - CVE-2026-81730

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the messages MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds filepath path . filename . . . ext and hands it to file_put_contents() and the private saveAttachment() in htdocs/emailcollector/class/emailcollector.class.php writes to destdir./.filename the name reaches both from the attachments own getNam