CVE-2026-24034: Horilla

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue.

Affected products

• Horilla Horilla: before 1.5.0 (fixed in 1.5.0)

Published 2026-01-22. Last modified 2026-06-17.