CVE-2025-48869
BaseFortify
Publication date: 2025-09-24
Last updated on: 2025-09-29
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| horilla | horilla | 1.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Horilla 1.3.0 allows unauthenticated users to access uploaded resume files by guessing or predicting their URLs. These files are stored in a publicly accessible directory, so attackers can retrieve sensitive candidate information without needing to log in or authenticate.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive candidate information, potentially exposing personal data to attackers. This can result in privacy breaches and misuse of the exposed information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could lead to non-compliance with data protection regulations such as GDPR and HIPAA because it allows unauthorized access to sensitive personal information, which violates requirements for protecting personal data and ensuring confidentiality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access uploaded resume files in Horilla 1.3.0 by guessing or predicting file URLs in the publicly accessible directory where these files are stored. Since the files are accessible without authentication, you can try to enumerate or brute force file URLs to check if sensitive candidate information is exposed. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate steps include restricting public access to the directory where resume files are stored to prevent unauthenticated users from accessing sensitive candidate information. Since there is no known patch at the time of publication, consider implementing access controls, such as authentication requirements or moving files to a non-public directory, to mitigate exposure.