CVE-2026-63432

Received Received - Intake

Template Attribute Traversal in Horilla HR CRM

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata. Django template restrictions prevent arbitrary code execution through this primitive, so the demonstrated impact is information disclosure and possible offline password cracking or account compromise. This issue is fixed in versions 1.6.0 and 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-63432

Affected Vendors & Products

Vendor	Product	Version / Range
horilla	hr_and_crm_software	to 1.6.0 (inc)
horilla	hr_and_crm_software	2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability affects Horilla HR and CRM software versions 1.0.0 to 1.6.0 and 2.0.0. It allows authenticated users to exploit template attribute traversal in the mail preview handlers to read sensitive data like request.user.password, request.META, and related-user attributes. This exposes password hashes, personal data, and server metadata.

Detection Guidance

Check Horilla versions between 1.0.0 and 1.6.0 or 2.0.0 by inspecting installed packages or application files. Look for unauthorized access to /recruitment/get-mail-preview/ or /employee/get-employee-mail-preview endpoints. Review server logs for unusual template attribute traversal patterns or requests to these paths.

Impact Analysis

An attacker could gain access to password hashes and personal data, leading to potential offline password cracking or account compromise. The vulnerability also exposes server request metadata, which may aid further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade Horilla to versions 1.6.0 or 2.0.0 or later immediately. If upgrading is not possible, restrict access to the vulnerable endpoints by modifying server configurations or firewall rules. Review and rotate exposed password hashes and sensitive data.

Hi! I’m here to help you understand CVE-2026-63432. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70