CVE-2025-48869: Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control
Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive candidate information without authentication. At time of publication there is no known patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48869?
CVE-2025-48869 is rated as a medium severity vulnerability due to unauthorized access to sensitive files.
How do I fix CVE-2025-48869?
To fix CVE-2025-48869, restrict access to the directory where uploaded resume files are stored and implement proper authentication checks.
Who is affected by CVE-2025-48869?
Users of Horilla 1.3.0 are affected by CVE-2025-48869 as it allows unauthenticated access to uploaded resume files.
What type of attack does CVE-2025-48869 allow?
CVE-2025-48869 allows attackers to retrieve uploaded resume files by directly guessing or predicting file URLs.
What version of Horilla contains the vulnerability CVE-2025-48869?
CVE-2025-48869 affects Horilla version 1.3.0.