The flaw permits an authenticated user to influence the email template path, which lets the application read any file on the server. This can disclose confidential data, expose internal configuration, and potentially leak system credentials. The vulnerability is a classic Path Traversal weakness.

OrangeHRM Open Source versions 5.0 through 5.8 are vulnerable. The issue was fixed starting with 5.8.1. All installations of the affected versions that are reachable via the web interface are at risk.

The CVSS score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests low current exploitation prevalence. The vulnerability is not listed in the CISA KEV catalog. The attack vector is strictly local or internal: an attacker must be able to authenticate to the OrangeHRM web interface to specify the template path. Successful exploitation requires that the web server process can read the targeted files, and the attacker benefits by obtaining arbitrary local file contents such as system configuration files, logs, or credential files.