CVE-2026-71483: Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View
Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Horillato a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Horilla versions before 1.6.0 are affected. Exploitation requires an authenticated employee or administrator to visit the employee filter view using an attacker-crafted link.
What does an attacker need to exploit it?
The attacker must craft and deliver a link containing a malicious search parameter and persuade an authenticated employee or administrator to open it. No attacker authentication is stated as necessary.
Are default deployments affected?
The issue is in the employee filter view's handling of the search parameter in versions before 1.6.0. The available data does not identify any configuration prerequisite or mitigation that would exclude a default deployment.
What should be done if patching is not immediately possible?
The provided information identifies version 1.6.0 as the fix but does not provide a temporary workaround. Until upgraded, limit exposure to attacker-supplied links and warn authenticated users not to open untrusted links to the employee filter view.
How can I determine whether my deployment is affected?
Check the installed Horilla version. Versions earlier than 1.6.0 are affected; version 1.6.0 contains the fix.