External risk intelligence

OrangeHRM Mail Configuration Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2025-66224

OrangeHRM is a web-based human resource management application. Such systems are commonly deployed as internet-facing web applications to provide access for employees and administrators from remote locations, making the underlying web service and its integrated workflows reachable from the public internet.

Code Injection

Orangehrm

5.0 to before 5.8

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An input neutralization flaw in OrangeHRM's mail system, affecting versions 5.0 through 5.7, allows attackers to write files on the server by manipulating email delivery. If these files are placed in web-accessible areas, it could lead to the execution of malicious content. This issue has been addressed in version 5.8.

Unsanitized input can lead to server file writing.
Critical systems could be compromised via email features.
Assess relevance and potential exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker with low-privileged access could exploit this vulnerability by sending specially crafted input through the mail configuration feature. This unsanitized input is then used in a system command, allowing the attacker to write files on the server. If these files are placed in a web-accessible location, the attacker can achieve code execution.

Requires authenticated, low-privilege access.
Triggers via mail configuration input.
Enables remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to write files on the server when processing emails. If these files are placed in a web-accessible location, it could lead to the execution of attacker-controlled content. This occurs because unsanitized user input is used in constructing OS-level command strings within the mail-sending logic.

Server-side files could be affected.
Malicious files may be written to web-accessible directories.
Attacker-controlled content execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability, which allows unauthorized file writes and potential code execution through the mail configuration. The first practical step is to identify all OrangeHRM instances, confirm their exposure, and determine business criticality before planning remediation.

Accountable teams must own remediation efforts.
Verify all OrangeHRM deployments are inventoried.
Plan upgrades or apply vendor patches accordingly.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OrangeHRM?

OrangeHRM is an integrated system designed for human resource management, used by organizations to handle employee data, leave requests, and administrative workflows. It is typically a web-based application that manages internal office processes and relies on various server-side components, including mail delivery modules, to facilitate communication between the system and its users.

How does CVE-2025-66224 work?

This vulnerability is an improper input neutralization flaw, classified as CWE-94. It occurs because the application takes user-provided data from email settings and inserts it directly into system-level commands. This bypasses security checks, allowing the underlying sendmail utility to misinterpret the input and perform unintended actions, such as writing arbitrary files to the server's filesystem.

Do I need to trigger the mail feature to be at risk?

Yes, the vulnerability requires the specific mail configuration and delivery workflow to be utilized. An attacker must supply specially crafted input through these settings to reach the unsafe command execution logic. Simply having the software installed without active mail configuration or interaction with the affected input paths will not trigger the flaw.

Is my instance relevant if it is internet-facing?

According to Halo Surface Signal, instances that are internet-facing are at higher risk because they are reachable from the public web. Since this bug allows for file writing on the server, an attacker who reaches the application over the internet can potentially move from basic authenticated access to full control over the host if those written files are placed in a web-accessible folder.

When should I update OrangeHRM?

You should prioritize upgrading to version 5.8 immediately. Because this issue allows for server-side file writes and potential code execution, it is critical to move off the vulnerable 5.0 through 5.7 range. Start by auditing your environment to locate all active deployments, verify the version, and schedule the update as part of your standard maintenance lifecycle.

References

github.com/orangehrm/orangehrm/security/advisories/GHSA-2w7w-h5w…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.