A critical file upload flaw exists in Horilla HRMS versions before 1.5.0 that permits authenticated users to upload a malicious HTML file disguised as a profile picture. The attacker can then host that file on the platform, presenting a convincing replica of the login page that captures credentials when a victim visits the URL. This enables a stealthy credential stealing attack that can culminate in full account takeover. The likely attack vector is an authenticated user uploading a deceptive file, followed by social engineering to lure a victim to the hosted page.

The vulnerability affects all deployments of Horilla HRMS running any version prior to 1.5.0. The affected product is the Horilla open-source HRMS, which lacks proper validation of uploaded file types.

The CVSS score for this issue is 8.0 and the EPSS indicates an exploitation probability of less than 1%, suggesting the flaw is considered high severity but currently low likelihood of being actively exploited. It is not listed in the CISA KEV catalog, and exploiting it requires an attacker to first obtain an authenticated session to upload the malicious file before persuading a victim to visit the crafted URL. The combination of these prerequisites results in a moderate exploitation risk for organizations that have active user bases and publicly expose the upload directory.