{"id":"CVE-2026-108101","published":"2026-10-09T15:17:10.667","lastModified":"2026-10-13T17:17:19.007","description":"HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://github.com/danielbrendel/hortusfox-web","tags":[]},{"url":"https://github.com/danielbrendel/hortusfox-web/blob/v6.3/app/models/PlantAttachmentModel.php#L28-L31","tags":[]},{"url":"https://github.com/danielbrendel/hortusfox-web/blob/v6.3/app/resources/js/app.js#L466","tags":[]},{"url":"https://github.com/danielbrendel/hortusfox-web/security/advisories/GHSA-8phf-v3xj-8jjg","tags":[]},{"url":"https://hackmd.io/@leediay/stored-xss-hortusfox-via-plant-attachment","tags":[]},{"url":"https://www.vulncheck.com/advisories/hortusfox-through-6.3-unrestricted-file-upload-via-plant-attachments","tags":[]}],"exploitRefs":[{"url":"https://github.com/danielbrendel/hortusfox-web","tags":[]},{"url":"https://github.com/danielbrendel/hortusfox-web/blob/v6.3/app/models/PlantAttachmentModel.php#L28-L31","tags":[]},{"url":"https://github.com/danielbrendel/hortusfox-web/blob/v6.3/app/resources/js/app.js#L466","tags":[]},{"url":"https://github.com/danielbrendel/hortusfox-web/security/advisories/GHSA-8phf-v3xj-8jjg","tags":[]}],"hasPoc":true,"ai":{"summary":"An authenticated user can upload arbitrary files to the server via a vulnerable endpoint, allowing for stored cross-site scripting or remote code execution through HTML/SVG or PHP files respectively. This vulnerability is particularly dangerous because it enables attackers to execute malicious code on the target system.","exploitability":"Exploitation requires an authenticated user account and is moderately difficult due to the need to upload a file with a client-supplied extension, but the attack surface is broad enough that it can be achieved through standard web application exploitation techniques.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the server, potentially leading to full system compromise, data exfiltration, or persistent access through malicious file uploads.","remediation":"Upgrade to HortusFox version 6.4 or later to address this unrestricted file upload vulnerability.","detection":"Monitor for unusual file uploads in the public/attachments/ directory, particularly HTML, SVG, or PHP files that are not expected to be uploaded by legitimate users.","tags":["file-upload","xss","rce","web"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:01:55.877Z"}}