CVE-2026-39345 orangehrm CVE debrief

Who should care

System administrators and security teams responsible for OrangeHRM Open Source installations, particularly those using versions between 5.0 and 5.8, should be aware of this vulnerability and take steps to mitigate it. They should review the vulnerability details, assess their exposure, and apply patches or mitigations as necessary.

Technical summary

The CVE-2026-39345 vulnerability in OrangeHRM Open Source allows an authenticated user to read arbitrary local files by manipulating the email template path. This is due to the system's failure to restrict file resolution to the intended plugins directory. The vulnerability has a CVSS score of 4.6 and is classified as MEDIUM severity. It is fixed in version 5.8.1 of OrangeHRM Open Source. System administrators and security teams should review their deployments, assess exposure, and apply patches or mitigations as necessary. Affected product deployments should be identified and prioritized for remediation, considering the potential impact of unauthorized file access. Additional security measures, such as restricting access to email template configuration and monitoring system logs for suspicious activity, are recommended to protect against this vulnerability.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it requires authentication but can lead to unauthorized file access.

Recommended defensive actions

• Apply the patch provided in version 5.8.1 of OrangeHRM Open Source.
• Restrict access to email template configuration to trusted users.
• Monitor system logs for suspicious file access attempts.
• Consider implementing additional access controls or security measures to protect sensitive files.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-04-07T19:16:45.480Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The OrangeHRM Open Source vulnerability CVE-2026-39345 allows an authenticated user to read arbitrary local files by manipulating the email template path due to the system's failure to restrict file resolution to the intended plugins directory. Evidence is limited to public CVE and NVD information.

Official resources