CVE-2026-39345
OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to the intended plugins directory, allowing an authenticated actor who can influence the template path to read arbitrary local files. This vulnerability is fixed in 5.8.1.
| CWE | CWE-22 |
| Vendor | orangehrm |
| Product | orangehrm |
| Published | Apr 7, 2026 |
| Last Updated | Apr 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for orangehrm orangehrm
Be the first to know when new unknown vulnerabilities affecting orangehrm orangehrm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
orangehrm / orangehrm
>= 5.0, < 5.8.1