Read the docs
TI-2026-63868 Aliases CVE-2026-96795

Horilla: Authenticated RCE in Horilla List-View Export

Priority HIGH 73CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix Fixed horilla-hr (horilla): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
horilla-opensourcehorilla-hrbefore 2.0.02.0.0Patch availableCNA
  • horilla-hr Vendorhorilla-opensource Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA

Remediation

  • Fix · CNA horilla-hr (horilla) Fixed in 2.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-96795

References

Other 2

  • TI-2025-37271 Horrila Stored XSS Vulnerability via Ticket Comment section CVSS 3.1CRITICAL 9.9
  • TI-2026-50095 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View CVSS 4.0HIGH 8.5
  • TI-2026-29522 Horilla: Unauthorized Document Overwrite via File Upload Endpoint CVSS 4.0HIGH 8.6
  • TI-2025-31025 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control CVSS 3.1HIGH 7.5
  • TI-2026-29521 Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> CVSS 4.0HIGH 7.1
  • TI-2026-19348 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover CVSS 3.1HIGH 8.0
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences