What is the CVSS score of CVE-2025-48783?

CVE-2025-48783 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Hr Portal are affected by CVE-2025-48783?

CVE-2025-48783 affects Soar Cloud HRD systems through version 7.3.2025.0408, allowing remote attackers to delete arbitrary files on affected servers.

How to fix or mitigate CVE-2025-48783?

Within 24 hours: Inventory all Soar Cloud HRD deployments and confirm versions; restrict network access to the application to trusted internal networks only. Within 7 days: Implement network-level controls (WAF rules blocking path traversal patterns in delete requests); disable the delete file function if not critical to operations; enable enhanced logging and monitoring of file operations. Within 30 days: Contact Soar Cloud for patched version availability; plan and execute upgrade to patched release; conduct file integrity audits to detect any unauthorized deletions.

Hr Portal CVE-2025-48783

EUVD-2025-17099 HIGH

External Control of File Name or Path (CWE-73)

2025-06-06 ART@zuso.ai

Information Disclosure Hr Portal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17099

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 10:15 nvd

HIGH 7.5

DescriptionCVE.org

An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to delete partial files by specifying arbitrary file paths.

AnalysisAI

CVE-2025-48783 is an external control of file name or path vulnerability (CWE-73) in the delete file function of Soar Cloud HRD Human Resource Management System versions up to 7.3.2025.0408, allowing unauthenticated remote attackers to delete arbitrary files by manipulating file path parameters. The vulnerability has a CVSS score of 7.5 with high integrity impact, enabling attackers to perform unauthorized file deletion without authentication. Exploitation requires only network access and no user interaction, making this a significant threat to organizations using affected HRD system versions.

Technical ContextAI

The vulnerability exists in the file deletion API endpoint of Soar Cloud HRD, where user-supplied input controlling the file path parameter is not properly validated or sanitized before being passed to file system operations. This represents a classic CWE-73 (External Control of File Name or Path) vulnerability where insufficient input validation allows path traversal or direct path specification attacks. The affected product is Soar Cloud HRD Human Resource Management System (CPE identifiable as vendor:soar, product:cloud_hrd or similar HR management suite). The delete function likely uses concatenation or direct file path construction without implementing proper canonicalization, whitelist validation, or path boundary checks. The vulnerability specifically affects the file deletion mechanism, suggesting the exposed endpoint is typically used for managing HR documents, employee records, or system files.

RemediationAI

Upgrade Soar Cloud HRD to a patched version beyond 7.3.2025.0408 (vendor should release 7.3.2025.0409 or later with path validation fixes)
If immediate patching is unavailable, implement network-level controls: restrict access to HRD APIs using firewall rules, VPN/bastion host requirements, or WAF rules to block suspicious file paths (e.g., patterns containing ../ or absolute paths)
Implement input validation on the client side and server side: whitelist allowed file names/paths, reject any path traversal sequences (../, ..\ ), and enforce that deletions only occur within designated safe directories
Enable comprehensive file system auditing and logging for all file deletion operations within the HRD system, allowing rapid detection and incident response
Implement robust backup and recovery procedures for critical HR data to minimize impact of unauthorized deletions
Monitor Soar Cloud's official security advisory channels for patch release announcements and apply patches immediately upon availability
Conduct a security assessment of other file handling functions (upload, read, write) in the HRD system to identify similar CWE-73 vulnerabilities