CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import
An authenticated administrator can achieve remote code execution by uploading a malicious theme archive containing PHP files to the web root.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104069?
CVE-2026-104069 is a high-severity vulnerability in danielbrendel hortusfox-web, published on 6 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.
Weakness: CWE-434
Which versions are affected by CVE-2026-104069?
How do I fix CVE-2026-104069?
No fix has been published for CVE-2026-104069 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104069 being exploited?
There is no known exploitation of CVE-2026-104069 in the wild and no public exploit code.
Sources
Also known as GHSA-6h79-56ph-ww3m.