External risk intelligence

Horilla Stored XSS Allows Session Hijacking

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-59832

Horilla is a Human Resource Management System (HRMS) web application. HRMS platforms are commonly deployed as web-based services accessible to employees and administrators over the network, frequently via the internet or internal enterprise portals. As a web application managing organizational data, it is typically configured for network reachability.

Cross-site Scripting

Horilla

before 1.4.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Horilla, an open-source Human Resource Management System, has a critical vulnerability that allows a low-privilege user to execute arbitrary JavaScript. This could enable them to hijack administrator sessions by stealing credentials, posing a risk to sensitive HR data. The issue has been addressed in version 1.4.0.

Stored XSS allows session hijacking.
Potential for sensitive HR data compromise.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access can leverage this vulnerability by submitting a malicious comment within the ticket system. This comment, when viewed by an administrator, will execute arbitrary JavaScript in their browser. This allows the attacker to steal sensitive information like session cookies and hijack the administrator's account.

Authenticated, low-privilege user access required.
Malicious script in ticket comment.
Session hijacking and data theft.

Live Threat

Current exploitation, exposure, and threat context

A stored cross-site scripting vulnerability in the ticket comment editor could allow a low-privilege user to execute arbitrary JavaScript in an administrator's browser when supported. This could lead to the exfiltration of sensitive session information.

Admin session data at risk.
JavaScript execution in admin browser.
Session hijacking by low-privilege user.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Horilla HRMS, likely managed by application owners or platform teams responsible for the HR system. The first action is to locate all instances of Horilla, assess their reachability and criticality, identify the specific owners, and then prioritize remediation efforts based on this risk assessment.

Application owners should lead remediation.
Verify all Horilla deployments and reachability.
Plan updates during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Horilla?

Horilla is an open-source Human Resource Management System (HRMS) used by organizations to manage employee data and administrative HR tasks. It functions as a web-based application, providing a centralized platform for staff and HR administrators to handle personnel workflows, record-keeping, and internal communication, including the ticket system affected by this issue.

How does CVE-2025-59832 work?

This vulnerability is classified as Stored Cross-Site Scripting (CWE-79). It means the software incorrectly handles input in the ticket comment editor. By saving a malicious script there, an attacker forces a victim's browser to execute that code when the comment is viewed. Because the browser treats the script as legitimate, it can leak private session cookies or tokens to the attacker.

What is required to trigger this vulnerability?

An attacker must first be an authenticated, low-privilege user within the Horilla application to submit a ticket comment. Simply visiting the application or browsing the site does not trigger the bug; the malicious script must be actively saved into the system's database. Once the script is stored, the vulnerability is triggered only when an administrator views that specific, compromised comment.

Why should I care about Horilla's network reachability?

Halo Surface Signal indicates that HRMS platforms like Horilla are commonly deployed as web-based services reachable over a network. If your instance is configured for access via the internet or an internal enterprise portal, the risk increases because the application is more accessible. Identifying if your Horilla deployment is internet-facing helps determine how easily an attacker might reach the system to attempt this.

How do I secure my Horilla deployment?

The primary step is to update your Horilla installation to version 1.4.0 or later, which contains the fix for this issue. Before applying the update, locate all instances of the software in your environment and identify the owners responsible for maintenance. Reviewing your deployment's reachability is also a recommended part of your initial assessment to prioritize where to patch first.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.