CVE-2026-24010: Horilla HRMS File Upload XSS Vulnerability

CVE-2026-24010 Overview

CVE-2026-24010 is a critical File Upload vulnerability affecting Horilla, a free and open source Human Resource Management System (HRMS). This vulnerability allows authenticated users to upload malicious HTML files disguised as profile pictures, enabling sophisticated phishing attacks that can lead to account takeover. When combined with social engineering techniques, attackers can create convincing fake login pages that harvest user credentials.

Critical Impact

Authenticated attackers can deploy phishing pages within the trusted Horilla application context, capturing user credentials and enabling full account takeover across the organization.

Affected Products

• Horilla HRMS versions prior to 1.5.0

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-24010 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-24010

Vulnerability Analysis

This vulnerability exists due to insufficient validation of file uploads in Horilla's profile picture functionality. The application fails to properly restrict the types of files that can be uploaded, allowing attackers to upload HTML files that contain malicious JavaScript and phishing content. The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as Injection.

The attack leverages the trust users place in URLs from their own organization's HRMS system. When a victim navigates to the URL of the uploaded malicious file, they encounter what appears to be a legitimate "Session Expired" message, prompting them to re-authenticate. The familiarity of the application domain significantly increases the likelihood that users will enter their credentials without suspicion.

Root Cause

The root cause of this vulnerability lies in the lack of proper file type validation and content-type enforcement in the file upload mechanism. The application does not adequately verify that uploaded files are legitimate image formats, nor does it sanitize or reject HTML content. This allows an attacker with valid authentication to upload arbitrary HTML files that are then served to other users within the application context.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access to the Horilla system. The exploitation chain proceeds as follows:

1. An authenticated attacker uploads a crafted HTML file through the profile picture upload functionality
2. The malicious HTML file contains a replica of the Horilla login page with JavaScript designed to capture credentials
3. The attacker obtains the URL where the uploaded file is accessible
4. Through social engineering (phishing emails, internal messages), the attacker convinces victims to visit the URL
5. Victims see an authentic-looking "Session Expired" message and enter their credentials
6. The captured credentials are exfiltrated to an attacker-controlled server, enabling account takeover

The attack is particularly effective because the malicious page is served from the legitimate Horilla domain, bypassing many user security awareness indicators. For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-5jfv-gw8w-49h3.

Detection Methods for CVE-2026-24010

Indicators of Compromise

• HTML files present in profile picture upload directories or storage locations
• Unusual file extensions in user upload directories (e.g., .html, .htm, .svg with embedded scripts)
• Outbound HTTP/HTTPS connections from user browsers to external domains after accessing internal HRMS URLs
• User reports of unexpected "Session Expired" prompts or login requests

Detection Strategies

• Monitor file upload endpoints for non-image MIME types and file extensions
• Implement Content Security Policy (CSP) headers to restrict script execution from uploaded content
• Review access logs for requests to uploaded files with HTML content types
• Deploy web application firewalls (WAF) with rules to detect HTML/JavaScript in file uploads

Monitoring Recommendations

• Enable detailed logging for all file upload operations including file type, size, and content analysis
• Set up alerts for login attempts that originate from unusual referrer URLs within the application
• Monitor for credential harvesting indicators such as form submissions to external domains
• Conduct periodic audits of uploaded files to identify potentially malicious content

How to Mitigate CVE-2026-24010

Immediate Actions Required

• Upgrade Horilla to version 1.5.0 or later immediately
• Audit existing uploaded files for any HTML or script content
• Remove any suspicious files discovered in profile picture directories
• Notify users about the potential phishing risk and advise them to report suspicious login prompts
• Reset credentials for any accounts that may have been compromised

Patch Information

The vulnerability has been addressed in Horilla version 1.5.0. Organizations should upgrade to this version or later to remediate the vulnerability. For details on the patch and upgrade instructions, refer to the GitHub Release Notes 1.5.0.

Workarounds

• Implement server-side file type validation that checks both the file extension and MIME type
• Configure the web server to serve uploaded files with Content-Disposition: attachment headers to prevent browser rendering
• Restrict the upload directory to only allow specific image formats (JPEG, PNG, GIF)
• Deploy Content Security Policy (CSP) headers with strict script-src directives to prevent JavaScript execution in uploaded content
• Consider using a separate subdomain or CDN for serving user-uploaded content to isolate it from the main application domain

# Example: Apache configuration to restrict uploads and prevent HTML rendering
<Directory "/var/www/horilla/uploads">
    # Only allow specific image file types
    <FilesMatch "\.(?i:jpg|jpeg|png|gif)$">
        Require all granted
    </FilesMatch>
    
    # Deny all other file types
    <FilesMatch "\.(?i:html|htm|svg|js)$">
        Require all denied
    </FilesMatch>
    
    # Force download instead of inline rendering
    Header set Content-Disposition "attachment"
    Header set X-Content-Type-Options "nosniff"
</Directory>