CVE-2023-38887

HIGH

Dolibarr ERP CRM < 17.0.1 - Unauthenticated Arbitrary File Upload via Extension Filtering Bypass

Title source: llm

Description

File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.

References (2)

Core 2

Core References

Product

http://dolibarr.com

Exploit, Third Party Advisory

https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38887_Dolibarr_AFU.pdf

Scores

CVSS v3 8.8

EPSS 0.0134

EPSS Percentile 67.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (2)

dolibarr/dolibarr 0 - 17.0.1Packagist

dolibarr/dolibarr_erp\/crm < 17.0.1

Published Sep 20, 2023

Tracked Since Feb 18, 2026