Loading vulnerability…
CVE-2026-89013 is an incorrect-authorization vulnerability in Dolibarr document-storage functionality affecting version 23.0.4 through versions before 24.0.1. A crafted hashp parameter with the value shared bypasses token validation while satisfying the flawed authorization condition, allowing an unauthenticated remote attacker to read arbitrary files accessible to the application.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This two-file repository contains a standalone Python 3 exploit and supporting README for CVE-2026-89013. CVE-2026-89013.py uses only the Python standard library and exposes check, list, read, download, viewimage, and hunt commands. It targets an authorization-bypass condition in Dolibarr's public-share handling: hashp=shared avoids share-token resolution but still triggers the endpoint's non-empty-hashp access override. The resulting unauthenticated requests can read files allowed by Dolibarr's modulepart-based document access logic, rather than providing unrestricted filesystem traversal. The built-in hunt workflow generates and concurrently probes likely SQL backup filenames and attempts known log and user-vCard locations. It also supports cross-entity requests, HTTP proxying, disabled TLS verification, configurable timeouts, parallel workers, and local saving of acquired files. README.md documents affected releases, the root cause, commands, example targets, and vendor patch references. No command-execution, shell, or persistence payload is present; the capability is data exposure and file acquisition.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An actively exploited critical arbitrary-file-read vulnerability in Dolibarr document-access endpoints. Inadequate authorization checks can allow an unauthenticated remote attacker to bypass token validation and read arbitrary files.
An unauthenticated authorization-bypass vulnerability in Dolibarr involving the hashp parameter. The supplied content does not provide further technical impact, affected versions, or exploitation details.
An unauthenticated authorization-bypass and arbitrary-file-read vulnerability in Dolibarr document storage endpoints. A crafted hashp=shared value bypasses token validation while satisfying authorization checks in htdocs/document.php and htdocs/viewimage.php, exposing logs, uploaded documents, database backups containing password hashes, and files of other multicompany entities.
An unauthenticated, network-exploitable authorization bypass in Dolibarr document storage endpoints. A crafted hashp=shared parameter bypasses token validation and permits arbitrary-file reads, exposing logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.