CVE-2023-38887

HIGH8.8EPSS 3.0%

File Upload vulnerability in Dolibarr ERP CRM

Published: 9/20/2023Modified: 4/3/2025

Also known as:GHSA-g8h7-mcp6-pf47BIT-dolibarr-2023-38887

Description

File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.

Affected packages (2)

Bitnami/dolibarrfrom 0, <= 17.0.1
Packagist/dolibarr/dolibarrfrom 0, < 17.0.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-38887
PATCHhttps://github.com/Dolibarr/dolibarr
WEBhttp://dolibarr.com
WEBhttps://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38887_Dolibarr_AFU.pdf