PT-2026-30968 · Orangehrm · Orangehrm

Rajitha Kumar + 1 · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39345

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.8

Description OrangeHRM Open Source versions 5.0 through 5.8 does not properly restrict email template file resolution to the intended plugins directory. This allows an authenticated actor who can influence the template path to read arbitrary local files.

Recommendations Update to version 5.8.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39345

Affected Products

Orangehrm

References · 3

• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-xq24-qv66-9v3m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39345 · Security Note
• https://twitter.com/CVEnew/status/2041603164072288523 · Twitter Post