CVE-2025-66224
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into the system's sendmail command. Because these values are not sanitized or constrained before being incorporated into the command execution path, certain sendmail behaviors can be unintentionally invoked during email processing. This makes it possible for the application to write files on the server as part of the mail-handling routine, and in deployments where those files end up in web-accessible locations, the behavior can be leveraged to achieve execution of attacker-controlled content. The issue stems entirely from constructing OS-level command strings using unsanitized input within the mail-sending logic. This issue has been patched in version 5.8.
Risk Assessment
An attacker may cause files to be written on the server, and if they become web-accessible, malicious content execution and application compromise are possible.
Recommendation
Update OrangeHRM to version 5.8 or later and ensure application-writable directories are not web-accessible.
Other vulnerabilities in OrangeHRM
See all- CVE-2026-39349Low
OrangeHRM Open Source from version 5.0 to 5.8 encrypts sensitive fields with AES in ECB mode, preserving plaintext patterns in ciphertext and enabling pattern disclosure against stored data. Fixed in version 5.8.1.
- CVE-2026-39348Medium
OrangeHRM Open Source versions 5.0 through 5.8 omit authorization on job specification and vacancy attachment download handlers. Authenticated low-privilege users can read attachments via direct reference to attachment identifiers.
- CVE-2026-39347Low
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records.
- CVE-2026-39346Medium
OrangeHRM Open Source from 5.0 to 5.8 allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. Fixed in 5.8.1.
- CVE-2026-39345Medium
OrangeHRM Open Source versions 5.0 to 5.8 fail to restrict email template file resolution to the intended plugins directory, allowing an authenticated attacker who can influence the template path to read arbitrary local files. This is fixed in version 5.8.1.
- CVE-2025-66291Medium
OrangeHRM versions 5.0 to 5.7 have an interview attachment retrieval endpoint in the Recruitment module that serves files based solely on an authenticated session and user-supplied identifiers, without verifying permission to access the associated interview record. An ESS-level user with no recruitment access can retrieve confidential documents such as candidate CVs and evaluations.
- CVE-2025-66290Medium
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application's recruitment attachment retrieval endpoint does not enforce the required authorization checks before serving candidate files. Even users restricted to ESS-level access, who have no permission to view the Recruitment module, can directly access candidate attachment URLs. As a result, any authenticated user can download CVs and other uploaded documents for arbitrary candidates, leading to unauthorized exposure of sensitive applicant data. This issue has been patched in version 5.8.
- CVE-2025-66289High
OrangeHRM versions 5.0 to 5.7 do not invalidate existing sessions when a user is disabled or a password is changed, so active session cookies remain valid indefinitely. A disabled or compromised account can continue accessing protected pages. Fixed in version 5.8.
- CVE-2025-66225High
In OrangeHRM 5.0 through 5.7, the password reset workflow does not enforce that the username in the final reset request matches the account for which the reset was initiated. An attacker can alter the username parameter to set a new password for any chosen account, including privileged ones.
Original NVD description (English source)
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into the system’s sendmail command. Because these values are not sanitized or constrained before being incorporated into the command execution path, certain sendmail behaviors can be unintentionally invoked during email processing. This makes it possible for the application to write files on the server as part of the mail-handling routine, and in deployments where those files end up in web-accessible locations, the behavior can be leveraged to achieve execution of attacker-controlled content. The issue stems entirely from constructing OS-level command strings using unsanitized input within the mail-sending logic. This issue has been patched in version 5.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS