PT-2025-48365 · Orangehrm · Orangehrm

Published 2025-11-29 · Updated 2025-11-29 · CVE-2025-66224

Positive Technologies · (AI Summary)

CVSS v4.0

9.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.7

Description OrangeHRM contains an input-neutralization flaw in its mail configuration and delivery workflow. User-controlled values are not sanitized before being used in the system’s sendmail command, allowing unintended sendmail behaviors during email processing. This can lead to the application writing files on the server, potentially enabling execution of attacker-controlled content if those files are in web-accessible locations. The issue arises from constructing OS-level command strings using unsanitized input within the mail-sending logic. The vulnerable component involves the

sendmail

command and its parameters.

Recommendations Upgrade to OrangeHRM version 5.8 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-66224

Affected Products

Orangehrm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-66224 · Security Note
• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-2w7w-h5wv-xr55 · Note
• https://twitter.com/0dayPublishing/status/1994608534529409054 · Twitter Post
• https://twitter.com/CVEnew/status/1994613186775884246 · Twitter Post