Vulnerability DatabaseCVE-2026-108101
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-108101
Published:October 09, 2026
Updated:October 13, 2026
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.
Related Resources (8)
https://www.vulncheck.com/advisories/hortusfox-through-6.3-unrestricted-file-upload-via-plant-attachments
https://hackmd.io/@leediay/stored-xss-hortusfox-via-plant-attachment
https://github.com/danielbrendel/hortusfox-web/blob/v6.3/app/resources/js/app.js#L466
https://github.com/danielbrendel/hortusfox-web/blob/v6.3/app/models/PlantAttachmentModel.php#L28-L31
https://github.com/danielbrendel/hortusfox-web
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108101.json
https://nvd.nist.gov/vuln/detail/CVE-2026-108101
https://github.com/danielbrendel/hortusfox-web/security/advisories/GHSA-8phf-v3xj-8jjg
Do you need more information?
Contact Us
CVSS v4
Base Score:
7.7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Unrestricted Upload of File with Dangerous Type
CWE-434
EPSS
Base Score:
0.39