TI-2026-70059 Aliases CVE-2026-108101

Unrestricted file upload in HortusFox lets users store scripts

LOW 36CWE-434Published 2026-10-09 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload flaw (CWE-434) in PlantAttachmentModel. It stores uploaded files under client-supplied extensions in public/attachments/, so an authenticated user with low privileges can upload HTML or SVG files for stored cross-site scripting, or PHP files that run code where .htaccess is not enforced.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00499 43rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
danielbrendel	hortusfox-web	up to 6.3	—	No fix listed	CNA

hortusfox-web Vendordanielbrendel Affected up to 6.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for hortusfox-web.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-09 Threatist record created from CVE-2026-108101
2026-10-11 Priority changed: MEDIUM → LOW
2026-10-13 CISA SSVC decision points changed

References

Advisory 1

GitHub Security Advisory (GHSA-8phf-v3xj-8jjg)

Other 4

TI-2026-62636 HortusFox-Web < 6.1 Remote Code Execution via Import/Export CVSS 4.0HIGH 8.6
TI-2026-68443 Remote code execution in HortusFox via theme import CVSS 4.0HIGH 8.6
TI-2026-70058 SQL injection in HortusFox API lets token holders read database tables CVSS 4.0HIGH 7.1
TI-2026-50818 Daniel Brendel HortusFox - Cross-Site Scripting CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences