CVE-2026-24034: Horilla has File Upload XSS
Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24034?
CVE-2026-24034 is considered a moderate severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2026-24034?
To fix CVE-2026-24034, upgrade Horilla to version 1.5.0 or later, which includes the necessary security patches.
What versions of Horilla are affected by CVE-2026-24034?
CVE-2026-24034 affects all versions of Horilla prior to 1.5.0.
What type of vulnerability is CVE-2026-24034?
CVE-2026-24034 is a cross-site scripting (XSS) vulnerability related to file uploads in Horilla.
Can CVE-2026-24034 be exploited remotely?
Yes, CVE-2026-24034 can potentially be exploited remotely through malicious file uploads.