The vulnerability is a Server‑Side Template Injection in the mail preview handlers of Horilla HR. An authenticated user who provides a valid CSRF token can inject malicious template expressions that traverse attributes of the request object, reading fields such as request.user.password and request.META. This allows leakage of password hashes, personal data, and server metadata, but does not lead to arbitrary code execution due to Django’s template restrictions.

Horilla HR, versions from 1.0.0 through 1.6.0 and the 2.0.0 release, contain the affected get_mail_preview endpoints in recruitment/views/actions.py and employee/not_in_out_dashboard.py. The issue is present in all releases up to and including 2.0.0 and is fixed in 1.6.0 and newer 2.0.0 revisions.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, so the exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with the application and possess a valid CSRF token, then supply a crafted template expression that accesses request attributes. The impact is limited to disclosure of sensitive data and potential offline password cracking rather than direct remote code execution.