CVE-2025-59524: Horilla HRMS XSS Vulnerability

CVE-2025-59524 Overview

CVE-2025-59524 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Horilla, an open source Human Resource Management System (HRMS). Versions prior to 1.4.0 perform file upload validation only in the browser and skip server-side checks. An attacker can bypass the client-side validation using an intercepting proxy or a crafted HTTP request. This lets the attacker upload an executable HTML document that runs when a privileged user views the file. The malicious script executes in the victim's browser context and can exfiltrate session cookies to an attacker-controlled endpoint. Version 1.4.0 patches the flaw.

Critical Impact
Unauthenticated attackers can upload malicious HTML files that hijack administrator sessions and impersonate privileged users in Horilla HRMS.

Affected Products

Horilla HRMS versions prior to 1.4.0
horilla:horilla open source package
Deployments exposing the file upload endpoints to untrusted users

Discovery Timeline

2025-09-24 - CVE-2025-59524 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59524

Vulnerability Analysis

The vulnerability resides in Horilla's file upload workflow. The application checks file type and content client-side using JavaScript in the browser. It does not repeat the checks server-side after receiving the upload. This design allows attackers to submit any file type by tampering with the request before it reaches the server. Once stored, the file is served back to authenticated users through Horilla's document viewing routes. Because the server does not enforce a safe Content-Type or sanitize the payload, HTML content is rendered inline. Any embedded <script> tags execute under the origin of the Horilla application.

Root Cause

The root cause is missing server-side input validation on uploaded files. The application relies exclusively on browser-side controls, violating the principle that client-side validation is a usability feature and not a security boundary. This maps to CWE-79 (Improper Neutralization of Input During Web Page Generation).

Attack Vector

An attacker intercepts a legitimate upload request using a proxy such as Burp Suite or crafts a raw multipart request. The attacker substitutes the file body with HTML containing JavaScript that reads document.cookie and sends it to an external URL. When an administrator opens the uploaded document, the script runs in the admin's browser session. The attacker collects the session identifier and replays it to impersonate the administrator. See the GitHub Security Advisory GHSA-mff9-p8j9-9v5q for technical details.

Detection Methods for CVE-2025-59524

Indicators of Compromise

Uploaded files with .html, .htm, .svg, or double extensions stored in Horilla document directories
Outbound HTTP requests from administrator browsers to unfamiliar domains carrying session cookie values
Unexpected Set-Cookie reuse or concurrent sessions from disparate IP addresses for the same admin account
Web server logs showing file uploads with Content-Type: text/html to Horilla upload endpoints

Detection Strategies

Inspect stored uploads for HTML, SVG, or JavaScript payloads that should not exist in HR document repositories
Enable web application firewall rules that flag multipart uploads containing <script> tags
Correlate authentication logs to identify session reuse from unusual geolocations following file views

Monitoring Recommendations

Log all file upload transactions with file hash, uploader identity, and MIME type for retrospective review
Alert on administrator account access from new IP addresses or user agents shortly after document access
Monitor egress traffic from user workstations to unknown destinations following interaction with HRMS document links

How to Mitigate CVE-2025-59524

Immediate Actions Required

Upgrade Horilla to version 1.4.0 or later, which enforces server-side upload validation
Audit existing uploads for HTML, SVG, or script-bearing content and remove suspicious files
Invalidate all active administrator sessions and rotate credentials after patching
Restrict access to Horilla file upload endpoints to authenticated internal users only

Patch Information

The fix is available in Horilla release 1.4.0. Administrators should follow the upgrade guidance in the release notes and validate that server-side file type checks are active after deployment.

Workarounds

Place Horilla behind a reverse proxy that strips or rewrites Content-Type: text/html responses for user-uploaded files
Serve uploaded content from a separate sandboxed domain with a restrictive Content-Security-Policy
Force downloads by setting Content-Disposition: attachment on all upload retrieval routes
Disable upload functionality for untrusted roles until the upgrade is complete

bash

# Nginx example: force download and block inline HTML rendering for Horilla uploads
location /media/uploads/ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "default-src 'none'; sandbox;";
    types { application/octet-stream html htm svg; }
}