CVE-2026-108101: Danielbrendel Hortusfox-Web

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

Affected products

• Danielbrendel Hortusfox-Web: up to and including 6.3

Published 2026-10-09. Last modified 2026-10-09.