Uncontrolled File Retrieval in OrangeHRM Human Resource Management System

CVE-2025-66291

What is CVE-2025-66291?

The OrangeHRM system contains a critical vulnerability within the Recruitment module, where the interview attachment retrieval endpoint can serve files based solely on an authenticated session and user-supplied identifiers. This lack of proper authorization checks allows unauthorized users, such as those with ESS-level access, to directly request and access confidential interview-related files, including candidate CVs and evaluations. The vulnerability arises due to the system's reliance on predictable object identifiers and session presence without validating user association with the recruitment process. A patch has been released in version 5.8 to address this issue.

References