Medium severity · published Sep 4, 2026
CVE-2026-85401
Dolibarr Legacy File Manager config.inc.php access control
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dolibarr · Dolibarr
21.0.0; 21.0.1; 21.0.2; 21.0.3; 21.0.4; 22.0.0; +9 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85401
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85401
github.com
https://github.com/Dolibarr/dolibarr/
github.com
https://github.com/Dolibarr/dolibarr/commit/ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec
github.com
https://github.com/Dolibarr/dolibarr/issues/38963
github.com
https://github.com/Dolibarr/dolibarr/pull/39731
github.com
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4
vuldb.com
https://vuldb.com/cve/CVE-2026-85401
More from Dolibarr
9.8
CVE-2019-19212
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen)
9.8
CVE-2018-16809
An issue was discovered in Dolibarr through 7.0.0
9.8
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to…
9.8
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes
9.8
CVE-2017-14242
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter