CVE -2026-96795 reveals a critical issue in Horilla, a human resources and CRM platform. The vulnerability lies in the export function and could lead to the execution of commands by a user already logged in to the application.
The National Vulnerability Database rates the vulnerability at 8.8 out of 10 , classifying it as high severity. The issue affects versions of Horilla prior to 2.0.0, and the fix was incorporated into version 2.0.0.
See also: SharePoint vulnerability allows authenticated remote execution
The export function and CVE-2026-96795
The vulnerability is located in the HorillaListView.export_data method , inside the horilla_views/generic/cbv/views.py file . The function accepts the columns parameter from the user and uses part of its value to dynamically generate Python code. The code is then passed to the exec() function , which can execute commands on the system.
The technical detail matters: this is not a simple data leak or display error. A properly formatted field can inject Python syntax into a default argument of a dynamic function. As long as the attacker has an account with access to that function, the application can execute commands with the privileges of the process.
The CVEFeed states that in environments where the official Docker image is run with administrator privileges, the consequences can be particularly severe. This does not mean that every installation is exposed in the same way; the final outcome depends on the account permissions, server configuration, and process privileges.
CVE -2026-96795 requires authenticated access, so it is not described as an anonymous remote attack. However, a compromised account, an overly privileged user, or a previous phishing attack could serve as a starting point. In a platform that stores employee data, contracts, and financial information, this chain should not be underestimated.
See also: Bifrost: Critical vulnerability allows remote command execution
The corrected version and security changes
Horilla version 2.0.0 includes a fix for this issue. The official project entry on GitHub marks 2.1.0 as a security release and recommends that those using 2.0.0 upgrade. The newer version incorporates fixes to access controls, code imports, and sensitive data protection.
According to the 2.1.0 release notes, the project has restricted column export paths, checked permissions on APIs, and closed issues involving employee data. These changes indicate that the upgrade is not just a version number change, but part of a broader overhaul of the platform’s architecture and permissions.
For organizations hosting Horilla internally, it is worth documenting whether the service is accessible from the internet and which roles can use exports. CVE-2026-96795 becomes more dangerous when an account with a limited business role has access to functions that generate dynamic code. The principle of least access should be applied to both the application and the container operating system.
Administrators should confirm which version is running on each installation and not just rely on the latest of a container. The SecNews technical team recommends using a specific version number, backing up the database and media folder, and testing the migration in a separate environment before production.
Immediate measures for administrators
The first step is to upgrade Horilla to 2.1.0 or later, where available and compatible with the installation. For cases where an immediate upgrade is delayed, limit access to the administration page and export function to only necessary accounts, via a management network or virtual private network.
In addition, review the logs for unusual calls to the export function, new administrator logins, and commands executed by the Horilla process. Change passwords and access tokens for accounts that may have been exposed, and check whether the container was running with more privileges than necessary.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Critical WordPress vulnerability being exploited
CVE -2026-96795 is a reminder that data extraction operations need the same rigorous scrutiny as login pages and APIs. Scaling, minimal access, and monitoring logs reduce the risk, especially for organizations using Horilla as a central HR system. Early response is important even when there is no evidence of exploitation, as attacks often start with already compromised credentials.
