CVE-2026-108101

Summary

An authenticated user can upload arbitrary files to the server via a vulnerable endpoint, allowing for stored cross-site scripting or remote code execution through HTML/SVG or PHP files respectively. This vulnerability is particularly dangerous because it enables attackers to execute malicious code on the target system.

Exploitability

Exploitation requires an authenticated user account and is moderately difficult due to the need to upload a file with a client-supplied extension, but the attack surface is broad enough that it can be achieved through standard web application exploitation techniques.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the server, potentially leading to full system compromise, data exfiltration, or persistent access through malicious file uploads.

Detection

Monitor for unusual file uploads in the public/attachments/ directory, particularly HTML, SVG, or PHP files that are not expected to be uploaded by legitimate users.

Prioritized remediation

Upgrade to HortusFox version 6.4 or later to address this unrestricted file upload vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.