CVE-2026-108101 Details

A vulnerability allowing unrestricted file uploads has been identified in HortusFox versions through 6.3, specifically within the PlantAttachmentModel. This flaw enables authenticated users to upload files with arbitrary extensions to the public/attachments/ directory. The absence of proper file type validation creates a risk of stored cross-site scripting (XSS) or, in cases where PHP files are uploaded and executed, remote code execution (RCE).

The vulnerability can be addressed by implementing a strict allowlist for file extensions in the PlantAttachmentModel. Additionally, uploaded files should be validated against their MIME types and magic bytes, served through a PHP controller to prevent direct web access, and accompanied by a per-directory .htaccess file that denies script execution.