# CVE-2025-66290: OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s…

Source: https://junglewise.ai/threats/cve-2025-66290-orangehrm-is-a-comprehensive-human-resource-management-hrm-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-29  
License: CC BY 4.0 with a link back

CVE-2025-66290 · Severity: medium · CVSS 4.3 · Published 2025-11-29

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does not enforce the required authorization checks before serving candidate files. Even users restricted to ESS-level access, who have no permission to view the Recruitment module, can directly access candidate attachment URLs. When an authenticated request is made to the attachment endpoint, the system validates the session but does not confirm that the requesting user has the necessary recruitment permissions. As a result, any authenticated user can download CVs and other uploaded documents for arbitrary candidates by issuing direct requests to the attachment endpoint, leading to unauthorized exposure of sensitive applicant data. This issue has been patched in version 5.8.

Technologies: [Orangehrm](https://junglewise.ai/threats/technologies/orangehrm). Vendors: [Orangehrm](https://junglewise.ai/threats/vendors/orangehrm).

## Quick answers

**Is CVE-2025-66290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66290 being exploited in the wild.

**How severe is CVE-2025-66290?** Medium severity, with a CVSS score of 4.3, published 29 November 2025.

**Which products and versions are affected?** Orangehrm. The advisory does not name versions.

**Is there a fix for CVE-2025-66290?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66290?** Check whether you run Orangehrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Orangehrm

## Related threats

- [OrangeHRM inadequate encryption strength in sensitive fields](https://junglewise.ai/threats/cve-2026-39349-orangehrm-inadequate-encryption-strength-in-sensitive-fields)
- [OrangeHRM missing authorization in attachment download handlers](https://junglewise.ai/threats/cve-2026-39348-orangehrm-missing-authorization-in-attachment-download-handlers)
- [OrangeHRM improper authorization in self-appraisal submissions](https://junglewise.ai/threats/cve-2026-39347-orangehrm-improper-authorization-in-self-appraisal-submissions)
- [OrangeHRM Open Source access control bypass in disabled modules](https://junglewise.ai/threats/cve-2026-39346-orangehrm-open-source-access-control-bypass-in-disabled-modules)
- [OrangeHRM path traversal in email template loader](https://junglewise.ai/threats/cve-2026-39345-orangehrm-path-traversal-in-email-template-loader)