Horilla HR EUVD-2026-87363

Requires an authenticated Horilla session (any user) plus a valid CSRF token to reach the mail-preview endpoints /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview in versions 1.0.0 through pre-1.6.0/2.0.0. The attacker supplies a user-controlled mail body containing Django template expressions; exploitation works against default configurations because the vulnerable handlers pass the full request object into the template context. Limiting factors: valid authentication (PR:L) and CSRF token are mandatory, and the Django template sandbox restricts the primitive to attribute reads (information disclosure) rather than code execution, so no arbitrary RCE is achievable.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium) is well-supported by the description and the confirmed patch: a network-reachable, low-complexity flaw requiring only a valid authenticated session, yielding high confidentiality impact (password hashes, PII, request metadata) with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is: no public exploit identified at time of analysis. The assigned CWE-94 (Code Injection) and the 'RCE' tag OVERSTATE the issue - the description explicitly notes Django template sandbox restrictions prevent arbitrary code execution, making the true weakness server-side template attribute traversal resulting in information disclosure (CWE-200/CWE-94-limited). This is therefore a genuine but bounded credential-exposure bug, not a code-execution priority; the C:H rating is justified because leaked password hashes enable offline cracking and downstream account compromise. Because exploitation requires authentication (PR:L) and there is no evidence of in-the-wild use, real-world urgency is moderate rather than critical - prioritize behind unauthenticated or actively-exploited issues but patch promptly given credential exposure.

An attacker with any valid low-privilege Horilla account and a CSRF token submits a mail-preview body containing Django template expressions such as {{ request.user.password }} or {{ request.META }} to /recruitment/get-mail-preview/ or /employee/get-employee-mail-preview. The server renders these against the full request object and returns the leaked password hashes, personal data, and request metadata, which the attacker then cracks offline to escalate. No public POC is referenced, but the commit diff confirms the exact traversal primitive.