CVE-2025-48869 - Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control

Back Back to CVE browser

HIGH

Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control

Published Sep 24, 2025

7.5

HIGH

CVSS 3.1

EPSS 0.43%

Description

Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive candidate information without authentication. At time of publication there is no known patch.

Affected products

Vendor Horilla-Opensource Product Horilla Default
unknown
Affected
- = 1.3.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Horilla-Opensource	Horilla	unknown	Affected = 1.3.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31031
Advisory
https://github.com/horilla-opensource/horilla/security/advisories/GHSA-99h5-x29f-727w
x_refsource_CONFIRMExploitVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31031		Advisory
https://github.com/horilla-opensource/horilla/security/advisories/GHSA-99h5-x29f-727w		x_refsource_CONFIRMExploitVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Sep 24, 2025

Updated Sep 24, 2025

Reserved May 27, 2025

Link CVE-2025-48869

CISA Vulnrichment

Updated Sep 24, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-48869

Red Hat

No data

ENISA EUVD

Assigner GitHub_M

Published Sep 24, 2025

Updated Sep 24, 2025

Link EUVD-2025-31031

GitHub

No data