Critical Vulnerability Information Vulnerability Overview Title: Unauthorized Access to Candidate Resume Files Due to Broken Access Control in Horilla v1.3 Severity: High (7.5/10) CVE ID: CVE-2025-48869 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Required Privileges: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None Affected Scope Affected Versions: 1.3 Fixed Versions: None Description Summary: Unauthorized users can directly access resume files uploaded in Horilla v1.3 by guessing or predicting file URLs. These files are stored in publicly accessible directories, allowing attackers to retrieve sensitive candidate information without authentication. Details: - After resumes are submitted via the recruitment application form, they are stored in a publicly accessible path: . - These PDF files are accessible over HTTP without any authentication or authorization checks. - Although filenames are not strictly sequential, they follow predictable or guessable patterns (e.g., resume123.pdf, cv.pdf), enabling attackers to enumerate or brute-force filenames to retrieve candidates' resumes. Proof of Concept (PoC) 1. Submit a resume via the public job application form: 2. Attempt to access the uploaded file by guessing or enumerating filenames, e.g., , , etc. 3. The file is returned without requiring authentication or authorization. Impact Vulnerability Type: Broken Access Control Affected Entities: All users who submitted resumes; their uploaded documents may be exposed to unauthorized third parties. Risk: Leakage of sensitive personal information (PII) to unauthorized attackers. Principle Violated: Principle of least privilege, potentially leading to unauthorized data exposure and privacy violations.