EUVD-2026-93436
GHSA-6h79-56ph-ww3m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible admin upload feature (AV:N/AC:L/UI:N) requiring administrator authentication (PR:H); arbitrary OS command execution yields full C/I/A impact with scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.
Articles & Coverage 1
AnalysisAI
HortusFox versions before 6.2 expose an authenticated remote code execution path through the theme import feature (ThemeModule::startImport): an uploaded ZIP archive is extracted into the public web root before file names, extensions, or content are validated, so an attacker with an administrator account can bundle a PHP payload and an .htaccess file that re-enables PHP execution and then execute arbitrary OS commands as the web-server user by requesting the dropped file under the themes directory. Exploitation is gated by administrator privileges (CVSS PR:H), so practical risk depends on obtaining or compromising an admin account; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated HortusFox administrator account and access to the theme import function (ThemeModule::startImport). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated remote code execution flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to HortusFox 6.2 (https://github.com/danielbrendel/hortusfox-web/releases/tag/v6.2), which removes unsafe files from imported themes via commit 3b87393d38ce408ec6f0946ffb3cbf0d08b5f07c and prevents import of potentially dangerous files via 1c7108f23fa30759d6f3bf62f0cfbf975bdc0a3b; there is no supported workaround that keeps vulnerable theme import functional, so patching is strongly preferred (see also https://www.vulncheck.com/advisories/hortusfox-remote-code-execution-via-theme-import). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify every HortusFox instance in the environment by version and confirm whether any remain below 6.2, then restrict or disable the theme import function for non-essential administrators and review administrator account rosters for stale, shared, or unnecessary privileged accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today