CVE-2025-48869 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control

What is CVE-2025-48869?

CVE-2025-48869 is a high-severity missing authorization vulnerability in horilla-opensource horilla, published on 24 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive candidate information without authentication. At time of publication there is no known patch.

Weakness: CWE-284

Which versions are affected by CVE-2025-48869?

It affects 1 product.

Products include Horilla Horilla.

How do I fix CVE-2025-48869?

No fix has been published for CVE-2025-48869 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-48869 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48869 exists.

Other vulnerabilities in horilla-opensource horilla

• CVE-2025-59832 Horrila Stored XSS Vulnerability via Ticket Comment section Critical 9.9
• CVE-2026-24010 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover High 8.8
• CVE-2026-24038 Horilla HR has 2FA Bypass through its OTP Handling Logic High 8.1
• CVE-2025-59524 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel High 7.7
• CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-99h5-x29f-727w.