HUMANIST HR CVE-2026-14194

The CVSS vector PR:L confirms that a valid low-privilege user account in the HUMANIST HR application is required - unauthenticated external actors cannot directly exploit this vulnerability. The attack is network-based (AV:N), so the attacker does not need local or adjacent network access; any network-reachable instance of the application is in scope. Attack complexity is low (AC:L), meaning no special server states, race conditions, or configuration prerequisites beyond the authentication requirement apply. No user interaction from a victim is needed (UI:N). Exploitation is bounded by the OS-level permissions of the web application process - files readable by the application service account are accessible; files with stricter permissions are not. Scope is unchanged (S:U), so the traversal cannot directly pivot to other systems from this flaw alone.

The NVD CVSS base score of 6.5 (Medium) reflects the PR:L authentication barrier that prevents fully unauthenticated exploitation, which meaningfully constrains the attacker population to those holding valid HUMANIST HR credentials. The high confidentiality impact (C:H) is genuine - successful exploitation enables unbounded read access to server-side files, potentially including HR records, configuration files, credentials, and OS-level data such as /etc/passwd or private keys. No EPSS score was provided in the available intelligence, making exploitation probability quantification impossible from this dataset. KEV status is absent, and no POC is referenced, suggesting this has not yet seen broad or opportunistic exploitation. The niche deployment footprint of this Turkish HR product further limits aggregate real-world exposure. Overall, organizations running HUMANIST HR 26.0 should treat this as a genuine data-disclosure risk requiring patching, particularly because HR systems routinely store sensitive personal and payroll data - but the risk does not extend beyond the authenticated user population.

An attacker who has obtained a valid HUMANIST HR user account - whether through phishing, credential stuffing, or insider access - submits a crafted HTTP request containing path traversal sequences (e.g., ../../etc/shadow or ../../../app/config.yml) to a file-access endpoint in the application. The server fails to normalize the supplied path and reads the file from the underlying OS filesystem, returning its contents to the attacker. No public POC has been identified, but the AC:L rating indicates exploitation is straightforward once credentials are in hand.