Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck

CVE-2026-92980HortusFox-Web < 6.1 Remote Code Execution via Import/Export

High 7.2

In plain English

A high-severity unrestricted file upload in hortusfox-web from danielbrendel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.0%top 37.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely for data portability, to deploy and execute malicious code on the underlying application server host.

Affected products (as reported)

Vendor	Product	Versions
danielbrendel	hortusfox-web	0 – before 6.1

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Official Patch patch, issue-tracking
HortusFox-Web v6.1 Release Notes release-notes
VulnCheck Advisory third-party-advisory