Hortusfox Web
Monthly
HortusFox versions before 6.2 expose an authenticated remote code execution path through the theme import feature (ThemeModule::startImport): an uploaded ZIP archive is extracted into the public web root before file names, extensions, or content are validated, so an attacker with an administrator account can bundle a PHP payload and an .htaccess file that re-enables PHP execution and then execute arbitrary OS commands as the web-server user by requesting the dropped file under the themes directory. Exploitation is gated by administrator privileges (CVSS PR:H), so practical risk depends on obtaining or compromising an admin account; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The vendor addressed the flaw in the 6.2 release, and the issue is tracked under CWE-434 (unrestricted upload of a file with a dangerous type).
HortusFox-Web releases prior to 6.1 expose the Import/Export data-portability feature to arbitrary file write, letting an authenticated administrator execute OS commands as the web server user by slipping a PHP file into the web-accessible public directory. The flaw carries a CVSS 4.0 score of 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:H/UI:N/C:H/I:H/A:H, high confidentiality, integrity and availability impact) and is gated behind administrator privileges plus the operator running an import of attacker-supplied data, so it is not remotely exploitable by an unauthenticated user on a default install. Vendor patching is available via the 6.1 release and the upstream commit 1c7108f; no public exploit code or confirmed active exploitation was identified at time of analysis.
HortusFox versions before 6.2 expose an authenticated remote code execution path through the theme import feature (ThemeModule::startImport): an uploaded ZIP archive is extracted into the public web root before file names, extensions, or content are validated, so an attacker with an administrator account can bundle a PHP payload and an .htaccess file that re-enables PHP execution and then execute arbitrary OS commands as the web-server user by requesting the dropped file under the themes directory. Exploitation is gated by administrator privileges (CVSS PR:H), so practical risk depends on obtaining or compromising an admin account; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The vendor addressed the flaw in the 6.2 release, and the issue is tracked under CWE-434 (unrestricted upload of a file with a dangerous type).
HortusFox-Web releases prior to 6.1 expose the Import/Export data-portability feature to arbitrary file write, letting an authenticated administrator execute OS commands as the web server user by slipping a PHP file into the web-accessible public directory. The flaw carries a CVSS 4.0 score of 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:H/UI:N/C:H/I:H/A:H, high confidentiality, integrity and availability impact) and is gated behind administrator privileges plus the operator running an import of attacker-supplied data, so it is not remotely exploitable by an unauthenticated user on a default install. Vendor patching is available via the 6.1 release and the upstream commit 1c7108f; no public exploit code or confirmed active exploitation was identified at time of analysis.