CVE-2026-63432: Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata
Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata. Django template restrictions prevent arbitrary code execution through this primitive, so the demonstrated impact is information disclosure and possible offline password cracking or account compromise. This issue is fixed in versions 1.6.0 and 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Horillato a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
Horillato a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
Which users could exploit the affected mail-preview functionality?
An attacker must be authenticated and have a valid CSRF token. The issue is therefore exploitable by a logged-in user who can submit a controlled mail body to either affected preview endpoint.
What information can be exposed through this issue?
Template attribute traversal can expose password hashes from request.user.password, request metadata from request.META, and attributes of related users. The disclosed data may include personal information and server-side request metadata.
Does this vulnerability enable remote code execution?
No arbitrary code execution is demonstrated through this primitive because Django template restrictions limit what can be executed. The documented impact is information disclosure, which could support offline password cracking or account compromise.
What versions contain the fix?
The issue is fixed in Horilla versions 1.6.0 and 2.0.0. Deploy one of those fixed versions to address the vulnerable mail-preview handlers.