HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extrac…
CVE-2026-104069 · GHSA-6h79-56ph-ww3m · EUVD-2026-93436 · published 6 Oct 2026
How serious is it
- Severity: high, CVSS score 8.6 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-104069?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- danielbrendel hortusfox-web: 0 <6.2
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- github.com/danielbrendel/hortusfox-web/releases/tag/v6.2
- github.com/danielbrendel/hortusfox-web/commit/3b87393d38ce408ec6f0946ffb3cbf0d08b5f07c
- www.vulncheck.com/advisories/hortusfox-remote-code-execution-via-theme-import
Merged from ENISA EUVD. Last updated 27 Oct 2026. All vulnerabilities · RSS · JSON