CVE-2026-63432

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-63432

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63432.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-63432

Aliases

GHSA-9p83-4w63-7c24

Published

2026-09-25T21:58:21Z

Modified

2026-09-27T03:47:33Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

Details

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata. Django template restrictions prevent arbitrary code execution through this primitive, so the demonstrated impact is information disclosure and possible offline password cracking or account compromise. This issue is fixed in versions 1.6.0 and 2.0.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63432.json"
}

References

Affected packages

Git / github.com/horilla/horilla-hr

Affected ranges

Type

GIT

Repo

https://github.com/horilla/horilla-hr

Events

Introduced

e3e08d66ae0e8f8ef6085257a4ed9d7212f9b030

Introduced

4a8614473f9ac18a6695ff81404dc61e118c5746

Fixed

b3bd29d15819cbece45c58e6268ddd0614e387d6

Fixed

edf0a1d18cec6b3d83437ce0ba93950973615e82

Fixed

bd3eed2168b0167f273a8dd7f218f1b37320ac39

Fixed

f1ca7cbc6216cb5bf19fc0174f49994ce5ffc2ad

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.0.0"
        },
        {
            "fixed":  "1.6.0"
        },
        {
            "introduced":  "2.0.0-beta.1"
        },
        {
            "fixed":  "2.0.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.2.1

1.2.2

1.2.3

1.3

1.3.1

1.3.2

1.4.0

1.5.0

2.*

2.0.0-rc1

release/v2.*

release/v2.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63432.json"