PT-2026-106761

CVE-2026-104069

Published

2026-10-06

Updated

2026-10-06

Description by

CVSS 4.0

8.6

High

MetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HortusFox versions prior to 6.2

Description An issue exists in the ThemeModule::startImport() function where uploaded ZIP archives are extracted directly into the public web root without validation of file names, extensions, or content. An authenticated administrator can exploit this by uploading a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, allowing the execution of arbitrary OS commands as the web-server user via the themes directory.

Recommendations Update to version 6.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Adam Młynarczyk

Vulncheck

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type