Skip to content
High-Risk CVE-2026-108101: Unrestricted File Upload in HortusFox

High-Risk CVE-2026-108101: Unrestricted File Upload in HortusFox

First seen 9 Oct 2026, 20:35 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 9, 2026 at 21:38 UTC
  • •CVE-2026-108101 allows file uploads leading to stored XSS.
  • •Affected versions of HortusFox are up to 6.3.
  • •Immediate action is required to mitigate risks from this vulnerability.

HortusFox versions up to 6.3 have an unrestricted file upload vulnerability (CVE-2026-108101) in the PlantAttachmentModel. This flaw allows authenticated users to upload potentially malicious files, such as HTML or SVG, which can lead to stored cross-site scripting (XSS) attacks. Attackers can exploit this by uploading files that execute JavaScript when accessed by other users. The vulnerability poses a high operational concern, especially for self-hosted deployments accessible by untrusted users. Mitigations include restricting uploads to trusted users and applying vendor patches as soon as they are available. The CVE was published on 2026-10-09 with a CVSS score of 7.7, indicating a high severity level. Current exploitation status remains unclear, and no specific threat intelligence has been provided.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-09
CVE-2026-108101 published
HortusFox vulnerability disclosed, allowing unrestricted file uploads leading to XSS attacks.
Redpacketsecurity
2026-10-09
Stored XSS vulnerability confirmed
The vulnerability allows attackers to upload malicious files that execute JavaScript when accessed by users.
hackmd.io

More articles in this cluster (4)

Following this threat?

Track CVE-2026-108101 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

What versions of HortusFox are affected?
HortusFox versions up to 6.3 are affected by CVE-2026-108101.
What are the risks associated with this vulnerability?
The vulnerability can lead to stored XSS attacks, allowing attackers to execute malicious scripts in the context of the application.
What immediate actions should be taken?
Restrict file uploads to trusted users and apply vendor patches as soon as they are available.