CVE-2026-39345

CVE-2026-39345 is a path traversal vulnerability affecting OrangeHRM Open Source versions 5.0 through 5.8 that permits authenticated users with the ability to influence template file paths to read arbitrary files from the affected system. The flaw stems from inadequate validation of email template file resolution, which fails to restrict access to the intended plugins directory. This vulnerability has been remediated in version 5.8.1. The vulnerability carries a CVSS v3.1 score of 4.9 (Medium severity) with a network-based attack vector that requires low complexity and high privilege credentials to exploit. While the confidentiality impact is rated as high, there is no integrity or availability impact associated with this issue. The attack does not require user interaction, making it executable by any authenticated administrator or privileged account capable of manipulating template paths. This vulnerability is not currently being actively exploited in the wild, as evidenced by its absence from the CISA Known Exploited Vulnerabilities catalog. The low EPSS score of 0.000520 indicates minimal likelihood of exploitation in real-world scenarios. Community attention remains limited, suggesting this issue has received modest attention relative to other disclosed vulnerabilities.