CVE-2026-24034: Horilla HRMS XSS Vulnerability

CVE-2026-24034 Overview

CVE-2026-24034 is a cross-site scripting (XSS) vulnerability in Horilla, a free and open source Human Resource Management System (HRMS). The vulnerability exists due to insufficient validation of file extension and content-type during the profile photo update functionality. Attackers with authenticated access can upload malicious files that execute JavaScript in the context of other users' sessions.

Critical Impact

Authenticated attackers can exploit the unrestricted file upload to inject malicious scripts, potentially stealing session cookies, performing actions on behalf of other users, or compromising sensitive HR data within the organization.

Affected Products

• Horilla HRMS versions prior to 1.5.0

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-24034 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-24034

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), which enables a stored cross-site scripting attack. The profile photo update functionality in Horilla HRMS lacks proper server-side validation of both file extensions and MIME content-types. This oversight allows attackers to bypass intended restrictions and upload files containing malicious JavaScript payloads disguised as image files.

When an authenticated user uploads a profile photo, the application fails to verify that the uploaded file is actually an image. An attacker can craft a file with an HTML or SVG extension containing JavaScript code, or manipulate the content-type header to bypass client-side checks. Once uploaded, the malicious content is stored on the server and executed when other users view the attacker's profile, making this a stored XSS vulnerability.

Root Cause

The root cause stems from the application's failure to implement proper file upload validation on the server side. The profile photo upload handler does not:

1. Validate file extensions against an allowlist of permitted image formats
2. Verify the actual MIME content-type of uploaded files through magic byte inspection
3. Sanitize or re-encode uploaded images to strip potentially malicious embedded content

This allows attackers to upload files with arbitrary content that the browser will interpret as executable when rendered.

Attack Vector

The attack is network-based and requires low-privilege authentication to the Horilla HRMS application. An attacker with valid user credentials can access the profile photo update functionality and upload a specially crafted file. The attack flow involves:

1. Authenticating to the Horilla HRMS with valid credentials
2. Navigating to the profile update section
3. Uploading a malicious file (such as an SVG containing JavaScript or an HTML file) as a profile photo
4. The malicious payload executes whenever another user views the attacker's profile

Since no user interaction is required beyond normal system usage (such as viewing employee profiles), this vulnerability poses a significant risk in multi-user HR environments where employees regularly access each other's profiles.

Detection Methods for CVE-2026-24034

Indicators of Compromise

• Unusual file types in profile photo storage directories (.html, .svg with embedded scripts, .js)
• Web server access logs showing profile photo requests with non-image MIME types being served
• Profile photo files containing <script> tags, JavaScript event handlers, or encoded payloads

Detection Strategies

• Monitor file upload directories for non-image file extensions or files with mismatched content-types
• Implement web application firewall (WAF) rules to detect script content in uploaded files
• Review application logs for profile update requests with suspicious content-type headers
• Deploy endpoint detection to identify browser-based exploitation attempts from stored XSS

Monitoring Recommendations

• Enable detailed logging on file upload endpoints to capture filename, content-type, and file size
• Configure security monitoring to alert on JavaScript execution originating from user-uploaded content directories
• Implement Content Security Policy (CSP) headers to restrict script execution sources
• Monitor for anomalous session activity that may indicate XSS-based session hijacking

How to Mitigate CVE-2026-24034

Immediate Actions Required

• Upgrade Horilla HRMS to version 1.5.0 or later immediately
• Audit existing profile photo storage for malicious files and remove any suspicious uploads
• Implement Content Security Policy (CSP) headers to mitigate XSS impact as a defense-in-depth measure
• Review access logs for signs of prior exploitation

Patch Information

The vulnerability has been addressed in Horilla HRMS version 1.5.0. Organizations should upgrade to this version or later to remediate the issue. Detailed release information is available in the GitHub Horilla Release 1.5.0 and the GitHub Security Advisory GHSA-mvwg-7c8w-qw2p.

Workarounds

• Implement server-side validation of file extensions using an allowlist approach (permit only .jpg, .jpeg, .png, .gif)
• Add MIME type verification using magic byte inspection to confirm actual file content matches declared type
• Configure web server to serve uploaded files with Content-Disposition: attachment to prevent browser rendering
• Deploy a web application firewall with rules to block file uploads containing script content

# Example nginx configuration to serve uploaded files safely
location /media/profile_photos/ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "default-src 'none'";
}