CVE-2025-48868 Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive
Authenticated attackers can execute arbitrary system commands via unsafe eval() usage in the project bulk archive feature.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48868?
CVE-2025-48868 is a high-severity code injection vulnerability in horilla-opensource horilla, published on 24 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval() function on a user-controlled query parameter in the project_bulk_archive view. This allows privileged users (e.g., administrators) to execute arbitrary system commands on the server. While having Django’s DEBUG=True makes exploitation visibly easier by returning command output in the HTTP response, this is not required. The vulnerability can still be exploited in DEBUG=False mode by using blind payloads such as a reverse shell, leading to full remote code execution. This issue has been patched in version 1.3.1.
Weakness: CWE-95
Which versions are affected by CVE-2025-48868?
It affects 1 product.
Products include Horilla Horilla.
How do I fix CVE-2025-48868?
No fix has been published for CVE-2025-48868 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-48868 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48868 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in horilla-opensource horilla
- CVE-2025-59832 Horrila Stored XSS Vulnerability via Ticket Comment section
- CVE-2026-24010 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover
- CVE-2026-24038 Horilla HR has 2FA Bypass through its OTP Handling Logic
- CVE-2025-59524 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel
- CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover
Sources
Also known as GHSA-h6qj-pwmx-wjhw.