Is CVE-2026-39345 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39345 being exploited in the wild.

How severe is CVE-2026-39345?

Medium severity, with a CVSS score of 4.9, published 7 April 2026.

Which products and versions are affected?

OrangeHRM OrangeHRM Open Source 5.0 to 5.8.

Is there a fix for CVE-2026-39345?

A patch was published on 2026-04-07: Fix released in version 5.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39345 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39345?

Check whether you run Orangehrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39345: OrangeHRM path traversal in email template loader

CVE-2026-39345 · Severity: medium · CVSS 4.9 · Published 2026-04-07

OrangeHRM, a popular human resource management platform, contains a security flaw in its email template system. An authorized user with high-level privileges can exploit this to access sensitive files stored on the server that they should not be able to see. This could lead to the exposure of configuration files or other internal system data, potentially compromising the security of the entire HR platform.

Technologies: Orangehrm. Vendors: Orangehrm.

Quick answers

Is CVE-2026-39345 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39345 being exploited in the wild.
How severe is CVE-2026-39345?: Medium severity, with a CVSS score of 4.9, published 7 April 2026.
Which products and versions are affected?: OrangeHRM OrangeHRM Open Source 5.0 to 5.8.
Is there a fix for CVE-2026-39345?: A patch was published on 2026-04-07: Fix released in version 5.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39345 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39345?: Check whether you run Orangehrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in OrangeHRM Open Source versions 5.0 through 5.8. The application fails to properly validate or restrict email template file resolution to the designated plugins directory. An authenticated attacker with high privileges (PR:H) who can influence the template path can use traversal sequences to read arbitrary local files on the underlying server. The vulnerability is exploited over the network without user interaction. The issue is resolved in version 5.8.1.

Affected products

OrangeHRM OrangeHRM Open Source 5.0 to 5.8

Timeline

2026-04-06: advisory: Vendor advisory published on GitHub
2026-04-07: disclosed: CVE published to NVD
2026-04-07: patched: Fix released in version 5.8.1

References

https://github.com/orangehrm/orangehrm/security/advisories/GHSA-xq24-qv66-9v3m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.