TI-2026-68443 Aliases CVE-2026-104069 GHSA-6h79-56ph-ww3m

Remote code execution in HortusFox via theme import

MEDIUM 40CWE-434Published 2026-10-06 · Updated 2026-11-08

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

HortusFox before 6.2 contains an unrestricted file upload flaw (CWE-434) in the theme import of ThemeModule::startImport(), which extracts uploaded ZIP archives into the public web root without validating file names, extensions or content. An authenticated administrator can upload a crafted theme archive that runs arbitrary OS commands as the web-server user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00531 45th percentileScored 2026-11-07

Fix Fixed hortusfox-web (danielbrendel): 6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
danielbrendel	hortusfox-web	before 6.2	6.2	Patch available	CNA

hortusfox-web Vendordanielbrendel Affected before 6.2 Fixed in 6.2 Patch available CNA

Remediation

Upgrade HortusFox (danielbrendel hortusfox-web) to version 6.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA hortusfox-web (danielbrendel) Fixed in 6.2

Timeline

2026-10-06 Threatist record created from CVE-2026-104069
2026-10-06 Alias added: GHSA-6h79-56ph-ww3m
2026-10-06 CISA SSVC decision points changed
2026-10-06 Priority changed: MEDIUM → LOW
2026-10-07 Priority changed: LOW → MEDIUM

References

Patch 1

Patch Commit

Other 1

hortusfox-web 6.2 Release Notes

TI-2026-62636 HortusFox-Web < 6.1 Remote Code Execution via Import/Export CVSS 4.0HIGH 8.6
TI-2026-70059 Unrestricted file upload in HortusFox lets users store scripts CVSS 4.0HIGH 7.7
TI-2026-70058 SQL injection in HortusFox API lets token holders read database tables CVSS 4.0HIGH 7.1
TI-2026-50818 Daniel Brendel HortusFox - Cross-Site Scripting CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences