Horrila Stored XSS Vulnerability via Ticket Comment section

The impact of this XSS vulnerability is significant. A successful attacker can inject arbitrary JavaScript code into the ticket comment editor, which will be executed in the context of any administrator viewing the comment. This allows the attacker to steal the administrator's session cookies or CSRF tokens, effectively hijacking their account. With control of the administrator's account, an attacker could perform any action within the HRMS, including accessing sensitive employee data, modifying records, or even compromising the entire system. This vulnerability is particularly concerning given the sensitive nature of HR data and the potential for widespread impact.

Organizations using Horilla HRMS, particularly those with multiple administrators and sensitive employee data, are at risk. Shared hosting environments where multiple customers share the same Horilla HRMS instance are also at increased risk, as a compromise of one customer's account could potentially lead to the compromise of others.

• linux / server: Monitor Horilla HRMS logs for unusual activity related to the ticket comment editor. Look for patterns indicative of script injection attempts. grep -i 'script' /var/log/horilla/access.log • generic web: Use curl or wget to test the ticket comment editor for XSS vulnerabilities. curl -X POST -d 'comment=<script>alert(1)</script>' http://your-horilla-instance/tickets/1/comments • database (mysql, postgresql): If Horilla HRMS uses a database, review the database schema for the ticket comments table. Ensure that appropriate sanitization and escaping are applied to prevent XSS attacks.

1. 2025-09-25Disclosure

   disclosure

1. Gereserveerd2025-09-22
2. Gepubliceerd2025-09-25
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-59832 is to upgrade Horilla HRMS to version 1.4.0 or later, which includes the necessary patch. If upgrading immediately is not possible, consider implementing stricter input validation and output encoding on the ticket comment editor to prevent the injection of malicious scripts. While not a complete solution, a Web Application Firewall (WAF) configured to block XSS payloads targeting the comment editor can provide an additional layer of defense. After upgrading, verify the fix by attempting to inject a simple JavaScript payload into a ticket comment and confirming that it is not executed.