2.1.1 — Security patch
Security patch release
This release fixes five security issues. Upgrading is recommended for all installations.
| Advisory | Severity | Issue |
|---|---|---|
| GHSA-rf47-2qgf-qq4j | High | Stored XSS leading to credential theft — XSS validation was bypassed on every REST and direct write |
| GHSA-cjr4-rrp6-g72j | High | Local file read through PDF generation, via an XSS-filter bypass |
| GHSA-56x4-6268-vg4f | High | Reimbursement approval could rewrite the claimed payout amount |
| GHSA-p745-9729-g8jw | Medium | A candidate could read any other candidate's uploaded documents |
| GHSA-mpw3-7c6v-vfjp | Medium | An employee could read any other employee's leave requests |
With thanks to @je-lv and @Pig-Tail for reporting these responsibly.
⚠️ Action required if you use WhatsApp
Set the Meta App Secret before or immediately after upgrading, or webhook delivery stops.
Horilla now verifies the X-Hub-Signature-256 header on every incoming WhatsApp webhook. Without a configured secret the request is refused — deliberately, because accepting unsigned webhooks allowed anyone who knew an employee's phone number to forge leave, attendance, asset and reimbursement requests as that employee.
Where to set it: WhatsApp credentials → App Secret. The value is in your Meta app under App Settings → Basic.
This failure is silent from a user's point of view — employees simply stop receiving replies, and the reason appears only in the server log. Please set it before your users notice.
Also in this release
- Rich text (ticket descriptions and comments, recruitment descriptions, policy bodies, OKR comments) is sanitised on output with an allow-list rather than a blocklist. Images and inline colour are preserved; scripts, event handlers and
javascript:/data:URLs are removed. - "Default Export Access" is now an explicit per-company setting rather than permissive-by-absence.
- API rate limiting, and outstanding tokens are revoked when a password changes.
Upgrading
No migration or configuration change is required beyond the WhatsApp App Secret above.
docker pull horilla/horilla-hr:2.1.1Full changelog: 2.1.0...2.1.1
