CVE-2025-48869 - CVE House

Back to Database

Status published High CVE-2025-48869

Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control

7.5 CVSS

Vulnerability Description

Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive candidate information without authentication. At time of publication there is no known patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48869

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/horilla-opensource/horilla/security/advisories/GHSA-99h5-x29f-727w

More from horilla-opensource

View All →

Horrila Stored XSS Vulnerability via Ticket Comment section

Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel

Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive

Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules

Affected Vendor

horilla-opensource

View all reports →

Affected Software

horilla

Vulnerable Versions:

= 1.3.0

Timeline

Official Publish: September 24th, 2025

Last Modified: September 24th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation