CVE Alert: CVE-2026-108101 – danielbrendel – hortusfox

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

**Risk verdict:** High operational concern; prioritise promptly, while confirming exploitation and threat-intelligence status because KEV, SSVC and EPSS data were not provided.

**Why this matters:** A low-privilege account could place active content where other users may access it, enabling account-targeted browser attacks and potential data or workflow manipulation. Server-side code execution is a more severe conditional outcome, depending on how the host handles uploaded files; the supplied data does not establish that this condition is present.

**Most likely attack path:** An attacker needs network access and an authenticated account, but no victim action is needed to submit an attachment. Stored content may affect users who later view it; compromise of the host is possible only if uploaded code is executed. Scope is assessed as unchanged, so downstream lateral movement is not established.

**Who is most exposed:** Self-hosted deployments reachable by untrusted or broadly provisioned users are most at risk, especially where attachments are served from the application host.

Alert on new attachments with executable or active-content extensions.

Compare file extensions, MIME types and detected file signatures.

Review upload and web-server logs for unusual attachment access or execution.

Check for unexpected files under the public attachment directory.

Mitigation and prioritisation

Apply the vendor’s fixed release as soon as available; verify the installed build against vendor guidance.

Until patched, restrict attachment uploads to trusted users and allowlisted file types.

Store uploads outside the web root or serve them as downloads with safe content headers.

Confirm server rules prevent execution in upload directories; test changes before deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.