PT-2026-30968 · Orangehrm · Orangehrm

Rajitha Kumar + 1 · CVE-2026-39345 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.8

Description OrangeHRM Open Source versions 5.0 through 5.8 does not properly restrict email template file resolution to the intended plugins directory. This allows an authenticated actor who can influence the template path to read arbitrary local files.

Recommendations Update to version 5.8.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39345

GHSA-XQ24-QV66-9V3M

Affected Products

Orangehrm

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39345.json · Exploit
• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-xq24-qv66-9v3m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-39345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39345 · Security Note
• https://twitter.com/CVEnew/status/2041603164072288523 · Twitter Post