PT-2025-48368 · Orangehrm · Orangehrm

Published 2025-11-29 · Updated 2025-11-29 · CVE-2025-66290

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.7

Description OrangeHRM, a human resource management system, allows unauthorized access to candidate files through its recruitment attachment retrieval endpoint. The application does not properly enforce authorization checks before serving candidate files. Users with limited access privileges, specifically those with ESS-level access who are restricted from the Recruitment module, can still access candidate attachment URLs. When a request is made to the attachment endpoint, the system verifies the session but fails to confirm if the user has the necessary recruitment permissions. This allows any authenticated user to download CVs and other uploaded documents for any candidate by directly requesting them from the attachment endpoint, resulting in the exposure of sensitive applicant data. The vulnerable endpoint is the recruitment attachment retrieval endpoint. The issue is resolved in version 5.8.

Recommendations Versions prior to 5.8 are affected. Update to version 5.8 or later to address this issue.

Exploit

Fix

Improper Authorization

Information Disclosure

Weakness Enumeration

CWE-285

CWE-200

Related Identifiers

CVE-2025-66290

GHSA-QF8R-C54J-JW88

Affected Products

Orangehrm

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66290.json · Exploit
• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-qf8r-c54j-jw88 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66290 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66290 · Vendor Advisory
• https://t.me/cveNotify/144326 · Telegram Post
• https://t.me/CVEtracker/38470 · Telegram Post
• https://twitter.com/CVEnew/status/1994613183445618776 · Twitter Post