Is there a patch available for CVE-2026-39345?

Yes, a patch is available for CVE-2026-39345. Update the affected software to the latest version immediately.

Orangehrm CVE-2026-39345

Q: What is the CVSS score of CVE-2026-39345?

CVE-2026-39345 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19855 MEDIUM

Path Traversal (CWE-22)

2026-04-07 GitHub_M

Path Traversal Orangehrm

4.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

5.8.1

EUVD ID Assigned

Apr 07, 2026 - 18:45 euvd

EUVD-2026-19855

Analysis Generated

Apr 07, 2026 - 18:45 vuln.today

CVE Published

Apr 07, 2026 - 18:17 nvd

MEDIUM 4.6

DescriptionGitHub Advisory

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to the intended plugins directory, allowing an authenticated actor who can influence the template path to read arbitrary local files. This vulnerability is fixed in 5.8.1.

AnalysisAI

OrangeHRM Open Source 5.0 through 5.8 allows authenticated users with high privileges to read arbitrary local files by manipulating email template file paths, bypassing the intended plugin directory restriction. The vulnerability requires high-privilege credentials and manual path influence but enables confidential file disclosure. Vendor has released patch version 5.8.1; no public exploit code or active exploitation is confirmed.

Technical ContextAI

OrangeHRM's email templating system uses file path resolution to locate template files within designated plugin directories. The vulnerability stems from insufficient path validation (CWE-22: Improper Limitation of a Pathname to a Restricted Directory), permitting path traversal sequences (e.g., '../../../etc/passwd') to escape the intended plugin directory boundary. An authenticated actor with high-privilege credentials can craft malicious template paths that the system resolves against the filesystem root rather than the restricted plugin scope, exposing sensitive configuration, credential, or source files. The issue affects all OrangeHRM versions 5.0 through 5.8 as identified via CPE cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade to OrangeHRM 5.8.1 or later. Organizations on versions 5.0 through 5.8 must apply this update to resolve the path traversal vulnerability. The patch restricts email template file resolution to the intended plugins directory, blocking traversal attempts. No workaround is available for vulnerable versions; patching is the only remediation path. Refer to the GitHub Security Advisory at https://github.com/orangehrm/orangehrm/security/advisories/GHSA-xq24-qv66-9v3m for additional context and verification of patch application.