CVE-2026-108101 HortusFox through 6.3 Unrestricted File Upload via Plant Attachments
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-108101?
CVE-2026-108101 is a high-severity vulnerability in danielbrendel hortusfox-web, published on 9 Oct 2026.
Official description
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.
Weakness: CWE-434
Which versions are affected by CVE-2026-108101?
How do I fix CVE-2026-108101?
No fix has been published for CVE-2026-108101 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-108101 being exploited?
There is no known exploitation of CVE-2026-108101 in the wild and no public exploit code.
Sources
Also known as GHSA-8phf-v3xj-8jjg, GHSA-m2c2-px87-9hp9.