CVE-2026-24010
Horilla ≤ 1.5.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2026-24010 is a high-severity Injection (CWE-74) vulnerability in Horilla Horilla. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24010 is a critical file upload vulnerability in Horilla, a free and open-source Human Resource Management System (HRMS), affecting versions prior to 1.5.0. Published on 2026-01-22, the flaw enables authenticated users to upload malicious HTML files disguised as profile pictures, facilitating phishing attacks through improper file handling. It carries a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is linked to CWEs-74 (Improper Neutralization of Special Elements), CWE-474 (Comparison of Classes by Name), and CWE-434 (Unrestricted Upload of File with Dangerous Type).
An authenticated attacker with low privileges can exploit this vulnerability by uploading a malicious HTML file that mimics Horilla's login page. Using social engineering, the attacker tricks a victim into visiting the publicly accessible URL of the uploaded file, where they encounter a convincing "Session Expired" message prompting re-authentication. The victim's entered credentials are captured and sent to the attacker's server, enabling full account takeover and potential further compromise within the HRMS environment.
Horilla version 1.5.0 fully patches this issue by addressing the file upload restrictions. Administrators are advised to immediately upgrade to version 1.5.0 or later. Additional details are available in the GitHub security advisory (GHSA-5jfv-gw8w-49h3) at https://github.com/horilla-opensource/horilla/security/advisories/GHSA-5jfv-gw8w-49h3 and the release notes at https://github.com/horilla-opensource/horilla/releases/tag/1.5.0.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4213
Vulnerability Data
Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as…
more
a profile picture, an attacker can create a convincing login page replica that steals user credentials. When a victim visits the uploaded file URL, they see an authentic-looking "Session Expired" message prompting them to re-authenticate. All entered credentials are captured and sent to the attacker's server, enabling Account Takeover. Version 1.5.0 patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.1.1V1.2.1V1.2.3V1.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing across OS versions can reveal behavioral differences caused by the inconsistent function.
SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.
Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.
Least functionality restricts the file types and automatic processing capabilities the system will accept.
Documented development standards and tools can prohibit or replace functions known to have inconsistent implementations.
Engineering principles can require use of portable, consistently implemented functions across platforms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
Secure SDLC practices directly require input validation and output encoding that prevent injection flaws.
Hardened configuration baselines can enforce allowed file types and processing rules.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches injection vulnerabilities before release.
Logging supports detection of injection attempts but does not prevent the weakness.
Monitoring activities can identify active injection attacks after they occur.
Secure development life cycle mandates input validation and output encoding that directly prevent injection flaws.
Application security requirements explicitly call for controls against injection attacks in software design.
Secure architecture principles reduce injection surfaces but do not prescribe specific neutralization techniques.