HortusFox: Remote code execution via theme import
Summary
HortusFox, a self-hosted plant management web application, extracts uploaded theme ZIP archives into the public web root before checking file names, extensions or content. An authenticated administrator can upload an archive containing a PHP file and an .htaccess file that re-enables script execution, then run arbitrary operating system commands as the web-server user. The attack requires administrator rights; no public exploit or active exploitation is known.
Affected
- HortusFox versions before 6.2
Fixed in
- Version 6.2 (commit 3b87393 and release tag v6.2)
Workaround
- Disable or restrict the theme import feature until the update is applied (third-party suggestion, not from the vendor).
- Restrict administrator access.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV according to third-party trackers.
- No public proof of concept found.
Our recommendation
- Identify all HortusFox instances and record their versions.
- Upgrade to version 6.2 or later, preferably the newest release.
- Until the upgrade, disable theme import if possible and restrict admin access.
- Check the themes directory for unexpected PHP or .htaccess files and review the logs for unexpected theme uploads.
- Review admin accounts and enforce strong passwords.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Commit 3b87393: Remove unsafe files from imported themes github.com
- HortusFox Release v6.2 github.com
- VulnCheck advisory: HortusFox RCE via Theme Import www.vulncheck.com
- NVD/Vulners record CVE-2026-104069 vulners.com
- OpenCVE CVE-2026-104069 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:20.
Original description (NVD)
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.