CVE-2025-48868
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-24

Last updated on: 2025-09-29

Assigner: GitHub, Inc.

Description
Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval() function on a user-controlled query parameter in the project_bulk_archive view. This allows privileged users (e.g., administrators) to execute arbitrary system commands on the server. While having Django’s DEBUG=True makes exploitation visibly easier by returning command output in the HTTP response, this is not required. The vulnerability can still be exploited in DEBUG=False mode by using blind payloads such as a reverse shell, leading to full remote code execution. This issue has been patched in version 1.3.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-24
Last Modified
2025-09-29
Generated
2026-06-16
AI Q&A
2025-09-24
EPSS Evaluated
2026-06-14
NVD
CVE-2025-48868
EUVD
EUVD-2025-30970
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
horilla horilla 1.3
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an authenticated Remote Code Execution (RCE) issue in Horilla 1.3.0. It occurs because the application unsafely uses Python's eval() function on a user-controlled query parameter in the project_bulk_archive view. This allows privileged users, such as administrators, to execute arbitrary system commands on the server. Exploitation is easier when Django's DEBUG mode is enabled, but it can still be exploited without DEBUG by using blind payloads like a reverse shell. The vulnerability was fixed in version 1.3.1.

Impact Analysis

This vulnerability can allow privileged users to execute arbitrary system commands on the server hosting Horilla. This could lead to full remote code execution, potentially compromising the entire server, exposing sensitive data, disrupting services, or allowing attackers to gain further access to the network.

Mitigation Strategies

Upgrade Horilla to version 1.3.1 or later, where the vulnerability has been patched. Additionally, ensure that Django's DEBUG setting is set to False in production environments to reduce the risk of visible command output during exploitation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-48868. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart