CVE-2025-48869

HIGH

7.5

Description

Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive candidate information without authentication. At time of publication there is no known patch.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published9/24/2025

Last Modified9/29/2025

Sourcenvd

Honeypot Sightings0

Affected Products

horilla:horilla

Weaknesses (CWE)

CWE-284

References

https://github.com/horilla-opensource/horilla/security/advisories/GHSA-99h5-x29f-727w(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.