What’s Vulnerable › Vulnerabilities

CVE-2026-92980: HortusFox-Web < 6.1 Remote Code Execution via Import/Export

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-09-22
• Weakness: CWE-434

Description

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely for data portability, to deploy and execute malicious code on the underlying application server host.

Affected products

• danielbrendel hortusfox-web: before 6.1 — fixed in 6.1

How to fix

Upgrade to a fixed version: danielbrendel hortusfox-web 6.1. Check the vendor advisory for mitigations.

References

• https://github.com/danielbrendel/hortusfox-web/commit/1c7108f23fa30759d6f3bf62f0cfbf975bdc0a3b
• https://github.com/danielbrendel/hortusfox-web/releases/tag/v6.1
• https://www.vulncheck.com/advisories/hortusfox-web-remote-code-execution-via-import-export

Get alerted when CVE-2026-92980 or the next vulnerability affects your stack