HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-108101 — HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulne...

·Source: NIST NVD

Updated:

Executive Summary

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

Analysis

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code. CVSS Score: 7.5. Published: 2026-10-09T15:17:10.667.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108101
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 9, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

How PHP's Coordinated Disclosure Process Went Belly Up

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/how-phps-coordinated-disclosure-process-went-belly-up-image_small-7-a-33176.jpg" align=right hspace=4><b>Open-Source PHP Team Also Admits to Decision Paralysis After 1 Flaw Found in 2024</b><br>The PHP Foundation said its coordinated vulnerability disclosure process for PHP2Shell worked, until it didn't. A demonstration video of a

Bank Info Security
MEDIUMVulnerabilityNEW

Microsoft shares how to fix broken Exchange Online EWS apps

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...]

BleepingComputer
MEDIUMVulnerabilityNEW

Fireblocks pours cold water on reports of $2.5bn acquisition talks with Visa

Digital asset and stablecoin infrastructure provider Fireblocks says that reports that it is in talks to be acquired by Visa for $2.5 billion are "news to us".

Finextra