CVE-2026-39345 — OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader

CVE-2026-39345

OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader PUBLISHED

Description (CNA)

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to the intended plugins directory, allowing an authenticated actor who can influence the template path to read arbitrary local files. This vulnerability is fixed in 5.8.1.

Affected (CNA)

Vendor / product	Versions
orangehrm / orangehrm	affected >= 5.0, < 5.8.1

CWE

CWE-22

References

https://github.com/orangehrm/orangehrm/security/advisories/GHSA-xq24-qv66-9v3m

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.