PT-2026-94834

CVE-2026-92980

Published

2026-09-17

Updated

2026-09-17

Description by

CVSS 4.0

8.6

High

MetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HortusFox-Web versions prior to 6.1

Description Authenticated administrators can execute arbitrary operating system commands as the web server user by abusing the Import/Export functionality. This feature, designed for data portability, can be leveraged to deploy and execute malicious code on the application server host.

Recommendations Update to version 6.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Adam Młynarczyk

Vulncheck

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type