Horilla, an open‑source HRMS, allows users to update profile pictures without validating file extensions or MIME types in versions prior to 1.5.0. This allows an attacker to upload a script disguised as an image that is then served and executed in the browser when other users view the profile, giving the attacker code‑execution capabilities within victim sessions. The issue is classified as CWE‑434, reflecting an improper input validation weakness.

Any installation of Horilla running a version earlier than 1.5.0 is vulnerable. The product is identified under horilla‑opensource:horilla, with no specific sub‑versions listed beyond the confirmed patch release at 1.5.0.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% coupled with no listing in the CISA KEV catalog suggests a low probability of widespread exploitation. Nevertheless, the vulnerability is easily exploitable once an attacker has the ability to upload a file; any user who views the affected profile could be impacted by the injected script.