CVE-2026-24034

Published: Jan 22, 2026Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue.

Affected (1)

Products: Horilla: Horilla

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Horilla Horilla	Before 1.5.0

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://github.com/horilla-opensource/horilla/releases/tag/1.5.0

Source: security-advisories@github.com

Release Notes

https://github.com/horilla-opensource/horilla/security/advisories/GHSA-mvwg-7c8w-qw2p

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.