CVE-2026-63432

Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

View on CVE.org

Published Sep 25, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata. Django template restrictions prevent arbitrary code execution through this primitive, so the demonstrated impact is information disclosure and possible offline password cracking or account compromise. This issue is fixed in versions 1.6.0 and 2.0.0.

Analysis

Technical impact

The vulnerability is a Server‑Side Template Injection in the mail preview handlers of Horilla HR. An authenticated user who provides a valid CSRF token can inject malicious template expressions that traverse attributes of the request object, reading fields such as request.user.password and request.META. This allows leakage of password hashes, personal data, and server metadata, but does not lead to arbitrary code execution due to Django’s template restrictions.

Affected Systems

Horilla HR, versions from 1.0.0 through 1.6.0 and the 2.0.0 release, contain the affected get_mail_preview endpoints in recruitment/views/actions.py and employee/not_in_out_dashboard.py. The issue is present in all releases up to and including 2.0.0 and is fixed in 1.6.0 and newer 2.0.0 revisions.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, so the exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with the application and possess a valid CSRF token, then supply a crafted template expression that accesses request attributes. The impact is limited to disclosure of sensitive data and potential offline password cracking rather than direct remote code execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

horilla

horilla-hr

affected

Version	Status	Constraints
`>= 1.0.0, < 1.6.0`	affected	—
`>= 2.0.0-beta.1, < 2.0.0`	affected	—

No data.

Vendor Product Versions

Horilla

Version	Status	Scheme	Platform
`[1.0.0,1.6.0)`	affected	semver	—
`[2.0.0-beta.1,2.0.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Horilla HR to version 1.6.0 or later;
Restrict access to the get_mail_preview endpoints to privileged roles only, such as administrators, to limit the number of users who can exploit the vulnerability.
Remove the full request object from the template context or sanitize template input to prevent attribute traversal.

Generated by OpenCVE AI on September 26, 2026 at 00:14 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.401% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/horilla/horilla-hr/commit/bd3eed2168b0167f273a8dd7f218f1b37320ac39
https://github.com/horilla/horilla-hr/commit/f1ca7cbc6216cb5bf19fc0174f49994ce5ffc2ad
https://github.com/horilla/horilla-hr/releases/tag/2.0.0
https://github.com/horilla/horilla-hr/security/advisories/GHSA-9p83-4w63-7c24

History

Sep 28, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 26, 2026 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Horilla Horilla horilla
Vendors & Products		Horilla Horilla horilla

Sep 25, 2026 10:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata. Django template restrictions prevent arbitrary code execution through this primitive, so the demonstrated impact is information disclosure and possible offline password cracking or account compromise. This issue is fixed in versions 1.6.0 and 2.0.0.
Title		Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata
Weaknesses		CWE-200 CWE-94
References		https://github.com/horilla/horilla-hr/commit/bd3eed2168b0167f273a8dd7f218f1b37320ac39 https://github.com/horilla/horilla-hr/commit/f1ca7cbc6216cb5bf19fc0174f49994ce5ffc2ad https://github.com/horilla/horilla-hr/releases/tag/2.0.0 https://github.com/horilla/horilla-hr/security/advisories/GHSA-9p83-4w63-7c24
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`