LoginSign Up
← Back to all sparks
I

IceHrm

HR
Velocity5.0

Human resource management system for employee records, leave and attendance.

icehrm.com ↗

IceHrm 36 rebuilds the interface, adds dark mode, and updates itself from the dashboard.

hr-softwareself-hostedui-rebuildself-updatingsecurity-fixes
◆Current state
IceHrm had been releasing about once a year until version 36.0.0 on September 14 rebuilt it as a single-page interface with dark mode, phone layouts and a dashboard updater with backup and rollback. Two security releases have followed: 36.0.1 fixed a stored XSS and an unauthenticated include, and 36.0.2 limits manager uploads to their own reports and moves Docker images to PHP 8.3.36 for two critical unauthenticated RCEs.
◆Where it's heading
After the big rebuild, IceHrm is in a hardening phase with monthly security patches. The built-in updater makes these fast follow-ups practical for self-hosters.
◆Prediction
More point releases fixing permission checks and platform-specific issues are likely before any new feature work appears.

◆Recent moves

  1. 8d ago

    IceHrm 36.0.2 tightens manager uploads and patches PHP RCEs

    The second security patch since the 36 rebuild: managers can no longer upload files for employees outside their team, and Docker images move to PHP 8.3.36 to fix two critical RCEs. It also fixes a 403 after login on Apache with PHP-FPM.

    View source ↗
  2. 8d ago

    Release branch merge for v36.0.2

    A merge commit for the v36.0.2 release branch, with no notes of its own.

    View source ↗
  3. 1mo ago

    IceHrm 36.0.1 fixes stored XSS and an unauthenticated include

    A security patch for 36.0.0 fixing a stored XSS in the checklist block and an update.php endpoint reachable without a session. It is also the first release delivered through the new in-app updater.

    View source ↗
  4. 2mo ago

    IceHrm 36: new single-page UI, dark mode, one-click updates

    Version 36.0.0 rebuilds IceHrm as a single-page app with grouped areas, module search, dark mode and phone layouts, and adds a one-click updater with rollback. It is the broadest release in the visible history, replacing the one-module-at-a-time pattern.

    View source ↗
  5. 7mo ago

    Travel management rebuilt and one-command upgrades

    Rebuilds the travel module with trip classification, a wide set of transport modes and booking details, and replaces the upgrade process with a single npm command. It follows the pattern of modernising one module per release.

    View source ↗
  6. 2y ago

    Microsoft sign-in and direct user invitations

    Adds Microsoft account login and the ability to invite users directly instead of creating employee and user records separately, alongside a reworked employee list and profile. Administrative friction is the target here, as in the later travel release.

    View source ↗