{
  "affected": [
    {
      "affectedData": [
        {
          "product": "horilla",
          "vendor": "horilla-opensource",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:horilla:horilla:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB689BA6-40B8-4E5F-AEB4-6DCB6C76A651",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python\u2019s eval() function on a user-controlled query parameter in the project_bulk_archive view. This allows privileged users (e.g., administrators) to execute arbitrary system commands on the server. While having Django\u2019s DEBUG=True makes exploitation visibly easier by returning command output in the HTTP response, this is not required. The vulnerability can still be exploited in DEBUG=False mode by using blind payloads such as a reverse shell, leading to full remote code execution. This issue has been patched in version 1.3.1."
    },
    {
      "lang": "es",
      "value": "Horilla es un Sistema de Gesti\u00f3n de Recursos Humanos (HRMS) de c\u00f3digo abierto y gratuito. Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) autenticada en Horilla 1.3.0 debido al uso inseguro de la funci\u00f3n \u0027eval()\u0027 de Python en un par\u00e1metro de consulta controlado por el usuario en la vista \u0027project_bulk_archive\u0027. Esto permite a los usuarios privilegiados (por ejemplo, administradores) ejecutar comandos de sistema arbitrarios en el servidor. Si bien tener \u0027DEBUG=True\u0027 de Django facilita visiblemente la explotaci\u00f3n al devolver la salida del comando en la respuesta HTTP, esto no es necesario. La vulnerabilidad a\u00fan puede ser explotada en modo \u0027DEBUG=False\u0027 mediante el uso de payloads ciegos, como una shell inversa, lo que lleva a una ejecuci\u00f3n remota de c\u00f3digo completa. Este problema ha sido parcheado en la versi\u00f3n 1.3.1."
    }
  ],
  "id": "CVE-2025-48868",
  "lastModified": "2026-09-26T00:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-48868",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-09-24T18:45:44.475358Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-24T14:15:49.593",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://drive.google.com/file/d/1XQAJilt77QxkjGEa94CsZRqZIZXa3ET9/view?usp=sharing"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://drive.google.com/file/d/1hnI9AK3fnpVrTlTRF7aRJsKhZCDIm2Ve/view?usp=sharing"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/horilla-opensource/horilla/commit/b0aab62b3a5fe6b7114b5c58db129b3744b4d8cc"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-h6qj-pwmx-wjhw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-95"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}