PT-2025-39264 · Horilla · Horilla

Naklehzeidan21 · Published 2025-09-24 · Updated 2025-09-29 · CVE-2025-48868

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.3.1

Description Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) issue exists due to the unsafe use of Python’s eval() function on a user-controlled query parameter in the project bulk archive view. This allows privileged users, such as administrators, to execute arbitrary system commands on the server. Exploitation is possible even when Django’s DEBUG mode is set to False, by using blind payloads like a reverse shell, resulting in full remote code execution.

Recommendations Update to version 1.3.1 or later.

Exploit

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2025-48868

GHSA-H6QJ-PWMX-WJHW

Affected Products

Horilla

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48868.json · Exploit
• 🔥 https://drive.google.com/file/d/1XQAJilt77QxkjGEa94CsZRqZIZXa3ET9/view?usp=sharing · Exploit
• 🔥 https://drive.google.com/file/d/1hnI9AK3fnpVrTlTRF7aRJsKhZCDIm2Ve/view?usp=sharing · Exploit
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-h6qj-pwmx-wjhw · Vendor Advisory
• https://github.com/horilla-opensource/horilla/commit/b0aab62b3a5fe6b7114b5c58db129b3744b4d8cc · Patch
• https://osv.dev/vulnerability/CVE-2025-48868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48868 · Security Note
• https://twitter.com/CVEnew/status/1970859173454729288 · Twitter Post
• https://twitter.com/cracbot/status/1972617415805796501 · Twitter Post
• https://t.me/CVEtracker/33257 · Telegram Post