CVE-2026-108101

Name of the Vulnerable Software and Affected Versions HortusFox (hortusfox-web) versions prior to 6.4

Description An unrestricted file upload issue exists in the PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions in the public/attachments/ directory. By using the '/plants/attachments/add' endpoint, attackers can upload HTML or SVG files to perform stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the server and served to other users. Additionally, if .htaccess is unenforced, PHP files can be uploaded to execute arbitrary code on the server.

Recommendations Update HortusFox (hortusfox-web) to version 6.4 or later. Restrict access to the '/plants/attachments/add' endpoint to minimize the risk of exploitation.