PT-2026-3908 · Horilla · Horilla

Buraksuu · Published 2026-01-22 · Updated 2026-01-22 · CVE-2026-24010

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.5.0

Description Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload issue, combined with social engineering techniques, allows authenticated users to launch phishing attacks. An attacker can upload a malicious HTML file, disguised as a profile picture, to create a login page replica that steals user credentials. When a victim accesses the uploaded file URL, they encounter a deceptive "Session Expired" message prompting re-authentication. All entered credentials are then sent to the attacker's server, potentially leading to Account Takeover. The vulnerable functionality involves uploading files, specifically HTML files, which are then served to other users. The API endpoint used for file uploads is not specified. The vulnerable parameter is the file upload field for profile pictures.

Recommendations Update Horilla to version 1.5.0 or later.

Exploit

Fix

Unrestricted File Upload

Special Elements Injection

Weakness Enumeration

CWE-434

CWE-74

CWE-474

Related Identifiers

CVE-2026-24010

GHSA-5JFV-GW8W-49H3

Affected Products

Horilla

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24010.json · Exploit
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-5jfv-gw8w-49h3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24010 · Security Note
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 · Note
• https://twitter.com/VulmonFeeds/status/2014228139929452942 · Twitter Post
• https://twitter.com/TheHackerWire/status/2014186769730920509 · Twitter Post
• https://t.me/CVEtracker/42736 · Telegram Post
• https://twitter.com/CVEnew/status/2014182480346292497 · Twitter Post
• https://twitter.com/CveFindCom/status/2014181033424363773 · Twitter Post