Remote Code Execution Vulnerability in Horilla Human Resource Management System

CVE-2025-48868

What is CVE-2025-48868?

Horilla, an open-source Human Resource Management System, has been identified with a vulnerability that allows authenticated users, particularly administrators, to exploit the unsafe use of the Python eval() function on user-controlled query parameters within the project_bulk_archive view. This flaw can lead to the execution of arbitrary system commands, potentially granting an attacker complete access to the server. While the exploitation could be evident when Django's DEBUG mode is enabled, the vulnerability remains viable even when set to DEBUG=False, enabling attackers to utilize techniques such as blind payloads for executing reverse shells. The vulnerability has been addressed and patched in version 1.3.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References