CVE-2026-63432Published
Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-63432 · Microsoft / collected KEV context
cve-program · CVE-2026-63432
- https://github.com/horilla/horilla-hr/security/advisories/GHSA-9p83-4w63-7c24
- https://github.com/horilla/horilla-hr/commit/bd3eed2168b0167f273a8dd7f218f1b37320ac39
- https://github.com/horilla/horilla-hr/commit/f1ca7cbc6216cb5bf19fc0174f49994ce5ffc2ad
- https://github.com/horilla/horilla-hr/releases/tag/2.0.0
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.