Read the docs
TI-2026-70058 Aliases CVE-2026-108100

SQL injection in HortusFox API lets token holders read database tables

Priority LOW 31CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

HortusFox (hortusfox-web) before 6.2 contains an SQL injection flaw (CWE-89) in the include_info parameter of the /api/locations/list endpoint. An attacker holding an API token can supply crafted include_info values with subqueries that are concatenated into the SQL column list, letting them read any database table, including user password hashes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint. Attackers can place subqueries in include_info, which PlantsModel::getSpecificInfo() concatenates into the column list, to read any database table including user password hashes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix Fixed hortusfox-web (danielbrendel): 6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
danielbrendelhortusfox-webbefore 6.26.2Patch availableCNA
  • hortusfox-web Vendordanielbrendel Affected before 6.2 Fixed in 6.2 Patch available CNA

Remediation

Upgrade danielbrendel hortusfox-web to version 6.2, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA hortusfox-web (danielbrendel) Fixed in 6.2

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-108100
  2. 2026-10-11 Priority changed: MEDIUM → LOW
  3. 2026-10-15 CISA SSVC decision points changed

References

Patch 1

Advisory 1

Other 3

  • TI-2026-62636 HortusFox-Web < 6.1 Remote Code Execution via Import/Export CVSS 4.0HIGH 8.6
  • TI-2026-68443 Remote code execution in HortusFox via theme import CVSS 4.0HIGH 8.6
  • TI-2026-70059 Unrestricted file upload in HortusFox lets users store scripts CVSS 4.0HIGH 7.7
  • TI-2026-50818 Daniel Brendel HortusFox - Cross-Site Scripting CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences