The vulnerability arises in horilla-opensource horilla when an attacker manipulates the prev_url argument in the global_search.py module, causing the application to redirect to a supplied URL. Classified as CWE-601, this open redirect flaw can be exploited remotely; based on the description it is inferred that this may facilitate phishing or lure users to malicious sites, potentially compromising trust and exposing sensitive data.

Affected versions include horilla-opensource horilla up to 1.0.2, with the vulnerability introduced in commit 730b5a44 and fixed in release 1.0.3. Administrators should check for these versions and determine whether the patch has been applied.

The CVSS base score of 5.3 indicates a moderate risk, while the EPSS rate of less than 1% suggests a low likelihood of exploitation at present. Based on the publicly documented remote attack capability, it is inferred that remediation is warranted to prevent user deception.