CVE-2026-24034
📋 TL;DR
Horilla HRMS versions before 1.5.0 contain a cross-site scripting vulnerability in the profile photo upload functionality. Attackers can upload malicious files that execute JavaScript in victims' browsers when viewed. This affects all organizations using vulnerable Horilla installations.
💻 Affected Systems
- Horilla HRMS
📦 What is this software?
Horilla by Horilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Attackers could steal user credentials or session tokens, leading to unauthorized access to HR data and systems.
If Mitigated
With proper input validation and content-type checking, malicious scripts would be blocked before execution.
🎯 Exploit Status
Exploitation requires authenticated access to upload profile photos, but the attack vector is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.0
Vendor Advisory: https://github.com/horilla-opensource/horilla/security/advisories/GHSA-mvwg-7c8w-qw2p
Restart Required: Yes
Instructions:
1. Backup your Horilla installation and database. 2. Download version 1.5.0 from GitHub releases. 3. Replace existing files with new version. 4. Restart the web server. 5. Verify functionality.
🔧 Temporary Workarounds
Disable profile photo upload
allTemporarily disable the profile photo upload functionality in Horilla settings
Web Application Firewall rules
allImplement WAF rules to block malicious file uploads and XSS payloads
🧯 If You Can't Patch
- Implement strict file upload validation at the web server level
- Use Content Security Policy headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check Horilla version in admin panel or by examining version files. If version is below 1.5.0, system is vulnerable.Check Version:
Check Horilla version in admin interface or examine version.txt file in installation directoryVerify Fix Applied:
After upgrading to 1.5.0, verify that file uploads now validate both file extension and content-type headers.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with suspicious extensions
- Multiple failed upload attempts
- Uploads with mismatched content-type headers
Network Indicators:
- HTTP POST requests to profile photo upload endpoints with unusual payloads
SIEM Query:
source="web_server" AND (uri="/upload/profile" OR uri="/profile/photo") AND (file_extension="html" OR file_extension="htm" OR content_type="text/html")