CVE-2026-92980
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, intended solely for data portability, to deploy and execute malicious code on the underlying application server host.
Risk Assessment
An authenticated administrator can execute arbitrary OS commands as the web server user, leading to full compromise of the application host. The risk is high because the Import/Export feature is abused to deploy malicious code.
Recommendation
Upgrade HortusFox-Web to version 6.1 or later. Limit the number of administrator accounts and monitor use of the Import/Export feature.
Other vulnerabilities in HortusFox-Web
See all- CVE-2025-45313Medium
An XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the title parameter. The attack can be executed without authentication if the endpoint does not require authorization.
- CVE-2025-45315Medium
An XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the email parameter, which executes in the victim's browser.
- CVE-2025-45314Medium
An XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the add function, executing in the victim's browser.
Original NVD description (English source)
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely for data portability, to deploy and execute malicious code on the underlying application server host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS