CVE-2026-39345 MEDIUM

CVE-2026-39345: OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader

Vendor Orangehrm
Product orangehrm
Weakness CWE-22 · Path traversal
Published April 7, 2026
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to the intended plugins directory, allowing an authenticated actor who can influence the template path to read arbitrary local files. This vulnerability is fixed in 5.8.1.

Key dates

02Disclosure timeline

April 7, 2026 CVE published
April 7, 2026 Record updated