Horilla HRMS version 1.3.0 is vulnerable to unauthenticated information disclosure, allowing unauthorized parties to access sensitive candidate resume files.

This is an improper access control issue (CWE-284) where resume files are stored in a predictable and publicly accessible directory, enabling unauthenticated attackers to exfiltrate sensitive data.

Successful exploitation of this vulnerability leads to the unauthorized disclosure of sensitive candidate information, including resumes, which may contain personally identifiable information (PII). This exposure poses a significant risk to candidate privacy, potentially resulting in regulatory non-compliance, legal liability, and long term reputational damage for the organization. With a CVSS score of 7.5, the vulnerability is classified as High severity due to its ease of exploitation and the sensitivity of the exposed data.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the directory containing uploaded resume files at the web server level.

Proactive Monitoring: Review web server access logs for anomalous patterns of sequential file requests or high volumes of 200 OK responses for file paths that should not be publicly accessible.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized requests to the directory hosting resume uploads, or move the storage location to a non-public directory requiring authenticated access.

Public Exploit Available: Unknown.

Given the absence of a vendor-supplied patch, organizations using Horilla HRMS 1.3.0 must prioritize immediate mitigation via server-side access controls. Restricting directory access or moving sensitive files to a protected location is critical to preventing the exposure of candidate data until an official security update is released.