CVE-2026-3049

low-risk
Published 2026-02-24

A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.3 is capable of addressing this issue. The patch is identified as 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The affected component should be upgraded.

Do I need to act?

-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Horilla

Affected Vendors

Horilla

References (6)

Exploit https://github.com/Stolichnayer/Horilla-CRM-Open-Redirect
Patch https://github.com/horilla-opensource/horilla-crm/commit/730b5a44ff060916780c44a...
Release Notes https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3
Permissions Required https://vuldb.com/?ctiid.347407
Third Party Advisory https://vuldb.com/?id.347407
Third Party Advisory https://vuldb.com/?submit.757296
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal