CVE-2026-24010
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-29
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| horilla | horilla | to 1.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-474 | The code uses a function that has inconsistent implementations across operating systems and versions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24010 is a critical file upload vulnerability in Horilla versions prior to 1.5.0. Authenticated users with permission to update profile photos can upload a malicious HTML file disguised as a profile picture by manipulating file extensions and headers. This uploaded file acts as a phishing page hosted on Horilla's domain, showing victims a realistic "Session Expired" login prompt that captures their credentials and sends them to the attacker. This enables attackers to steal user credentials and take over accounts. [1]
How can this vulnerability impact me? :
This vulnerability can lead to account takeover by harvesting user credentials through phishing hosted on the legitimate Horilla domain. Attackers can gain unauthorized access to sensitive HR data such as employee personal information, payroll records, and administrative controls. The impact includes data breaches, financial fraud, and operational disruption. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of malicious HTML files uploaded as profile pictures by authenticated users with profile photo update permissions. One can look for files with suspicious extensions or content types that are HTML but disguised as images. Additionally, monitoring network traffic for unusual outbound connections to attacker-controlled servers when users enter credentials on suspicious URLs can help detect exploitation. A practical approach includes listing uploaded profile pictures and inspecting their file types and contents. For example, commands to find HTML files in the upload directory might include: `find /path/to/uploads -type f \( -name '*.html' -o -name '*.htm' \)` or using `file` command to detect files with HTML content masquerading as images. Network monitoring tools or running a listener like `netcat` on expected ports can help detect credential exfiltration attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Horilla to version 1.5.0 or later, where this vulnerability has been patched. Additionally, restrict profile photo update permissions to trusted users only, and implement strict validation and sanitization of uploaded files to prevent HTML or other executable content from being uploaded as images. Monitoring and removing any suspicious uploaded files and educating users about phishing risks can also help reduce impact. [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability enables attackers to perform account takeover and potentially access sensitive HR data such as employee personal information and payroll records. Such unauthorized access and data breaches could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information. Therefore, exploitation of this vulnerability may result in violations of these standards due to compromised confidentiality and unauthorized data exposure. [1]