CVE-2025-48780 is a critical flaw (CVSS 9.8) in the download file function of Soar Cloud HRD Human Resource Management System, through version 7.3.2025.0408. A crafted serialized object lets a remote attacker run system commands. The advisory names no fixed version, so contact the vendor for updates.
What's affected
The CVE record says Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 is affected. The advisory from ZUSO ART, dated 6 June 2025, repeats that, lists the vendor as Soar Cloud System Co., Ltd., and scores the issue 9.9 on CVSS 4.0. Its mitigation line says to contact Soar Cloud for version updates.
No fixed version is named in the record or in the advisory. Do not assume that a later build number is safe until the vendor confirms it in writing. A sibling issue in the upload function of the same product, CVE-2025-48782, was published the same day with the same affected range.
The product is an HR system, so the data at stake includes employee records. The CVSS vector shows network reach, low complexity, no privileges and no user interaction.
How to check if you're exposed
Identify whether your organisation uses this product, including hosted copies run by a service provider. Ask your IT or HR systems owner for the version in use, which is normally shown in the product's about page or in the vendor's release information.
If the version is 7.3.2025.0408 or earlier, you are in the affected range. If you run the system on your own servers, check which networks can reach it. An HR system should not need to be reachable from the whole internet.
Review web server logs for requests to the file download feature from unfamiliar addresses, and look for unexpected processes started by the web application account:
ps -eo user,pid,ppid,cmd --sort=start_time | tail -n 40
That command lists the most recently started processes on a Linux host. Adapt it to your platform, and ask your server team to check for child processes of the application server that you do not recognise.
What to do now
- Contact Soar Cloud now and ask for a fixed build and written confirmation of the version that contains the fix.
- Restrict network access to the application to the users and offices that need it, using a VPN or an allow list.
- Put a web application firewall or reverse proxy rule in front of the file download feature if your tooling supports it, and test it on a copy first.
- Review logs and file systems for signs of abuse. If you find them, treat the host as compromised, rotate credentials and tell your data protection contact.
- Record the decision and the vendor reply for your audit trail.
Why it matters
The weakness is CWE-502, deserialization of untrusted data. An application turns bytes it received back into objects. If an attacker controls the bytes, the objects can be built to trigger behaviour the developers did not intend, and in many languages that includes running commands. The advisory describes the result as arbitrary system command execution.
The right design is to avoid deserializing native objects from user input at all, and to use plain data formats with explicit checks instead. If a product needs a binary format, it should verify an integrity signature before it processes the data.
The record does not list the issue in the CISA Known Exploited Vulnerabilities catalogue, and the advisory does not say it was exploited. An HR system holds personal data covered by data protection law, so containment steps are worth taking before a patch is available.
Quick check
Is there a fixed version of Soar Cloud HRD?
The advisory names none. It says to contact Soar Cloud for version updates, so ask the vendor and get the answer in writing.
Is this the same as CVE-2025-48782?
No. That issue is an unrestricted file upload in the same product, with the same affected range. Both need the vendor's update.
Sources
Last reviewed: 18 October 2026.
