CVE-2026-104069
Deferred Deferred - Pending Action

Remote Code Execution in HortusFox CMS

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: VulnCheck

Description
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-104069
EUVD
EUVD-2026-93436

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
danielbrendel hortusfox-web 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HortusFox before version 6.2 has a remote code execution flaw in the ThemeModule::startImport() function. It allows an authenticated admin to upload a malicious ZIP archive that extracts directly into the public web directory without validating file names, extensions, or content. The attacker can include a PHP file and an .htaccess file to bypass restrictions and execute arbitrary operating system commands as the web server user.

Detection Guidance

Check for unauthorized PHP files in the themes directory or web root. Look for suspicious .htaccess files that may re-enable execution. Review logs for uploads of ZIP archives followed by requests to theme-related paths.

Impact Analysis

This vulnerability allows an attacker with admin access to execute arbitrary commands on the server. This could lead to full system compromise, data theft, unauthorized modifications, or disruption of services. The impact depends on server permissions and network access.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade HortusFox to version 6.2 or later. Remove any unauthorized files in the themes directory. Restrict write permissions to the web root. Monitor for unusual file uploads or execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104069. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart