CVE-2025-59524 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel
Attackers can upload malicious HTML files to trigger stored XSS, stealing admin session cookies and gaining unauthorized access to the HRMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59524?
CVE-2025-59524 is a high-severity cross-site scripting vulnerability in horilla-opensource horilla, published on 24 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, the file upload flow performs validation only in the browser and does not enforce server-side checks. An attacker can bypass the client-side validation (for example, with an intercepting proxy or by submitting a crafted request) to store an executable HTML document on the server. When an administrator or other privileged user views the uploaded file, the embedded script runs in their context and sends session cookies (or other credentials) to an attacker-controlled endpoint. The attacker then reuses those credentials to impersonate the admin. This issue has been patched in version 1.4.0.
Which versions are affected by CVE-2025-59524?
It affects 1 product.
Products include Horilla Horilla.
How do I fix CVE-2025-59524?
No fix has been published for CVE-2025-59524 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-59524 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59524 exists.
Other vulnerabilities in horilla-opensource horilla
- CVE-2025-59832 Horrila Stored XSS Vulnerability via Ticket Comment section
- CVE-2026-24010 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover
- CVE-2026-24038 Horilla HR has 2FA Bypass through its OTP Handling Logic
- CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover
- CVE-2025-48869 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control
Sources
Also known as GHSA-mff9-p8j9-9v5q.