The vulnerability arises in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root without any validation of file names, extensions, or contents. An authenticated administrator can upload a crafted archive containing a PHP file and an .htaccess file that re‑enables PHP execution, then request the file under the themes directory, leading to arbitrary OS command execution as the web‑server user. This constitutes a remote code execution flaw classified as CWE‑434 (Unrestricted Upload of File with Dangerous Type).

The affected product is HortusFox Web from vendor Daniel Brendel (danielbrendel:hortusfox-web). Any installation running a version earlier than 6.2 is vulnerable. The flaw exists in all releases published before the v6.2 release in September 2026.

The CVSS score of 8.6 indicates a high level of severity, while the EPSS score is not publicly available. The flaw is not listed in CISA's KEV catalog, yet the ability to execute arbitrary code remains a critical threat. Exploitation requires authenticated administrative access; the attacker must first log in as an administrator, then use the theme import interface to upload the crafted archive and trigger execution. Once exploited, the attacker gains full control over the web‑server’s file system and can execute arbitrary OS commands.