Vulnerability · Published Feb 24, 2026 · Assigned by VulDB

CVE-2026-3049horilla-opensource horilla Query Parameter global_search.py get redirect

Medium 4.3

In plain English

A medium-severity open redirect in horilla from horilla-opensource. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 61.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.3 is capable of addressing this issue. The patch is identified as 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The affected component should be upgraded.

Affected products (as reported)

Vendor	Product	Versions
horilla-opensource	horilla	1.0.01.0.11.0.2

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

References

VDB-347407 | horilla-opensource horilla Query Parameter global_search.py get redirect vdb-entry, technical-description
VDB-347407 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #757296 | Horilla CRM < 1.0.3 Open Redirect third-party-advisory
https://github.com/Stolichnayer/Horilla-CRM-Open-Redirect exploit
https://github.com/horilla-opensource/horilla-crm/commit/730b5a44ff060916780c44a4bdbc8ced70a2cd27 patch
https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3 patch