# CVE-2026-108101 - HortusFox through 6.3 Unrestricted File Upload via Plant Attachments
The plant attachment functionality allows users to upload files without properly validating or restricting the allowed file types.
An attacker can upload files with extensions such as .html, .htm, or .svg containing malicious JavaScript. These files are subsequently stored by the application and can be accessed by other users.
An attacker can upload files with extensions such as .html, .htm, or .svg containing malicious JavaScript. These files are subsequently stored by the application and can be accessed by other users. When a victim opens the uploaded file through the application, the embedded JavaScript may be executed in the context of the application's origin, resulting in a Stored Cross-Site Scripting (XSS) vulnerability.
Video exploit: [here](
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
