The vulnerability exists in the PlantAttachmentModel of HortusFox Web, allowing authenticated users to upload files with any client‑supplied extension to a publicly accessible directory. An attacker can store malicious HTML or SVG files for stored cross‑site scripting, or PHP files that can be executed if server configuration does not block execution in that directory. This flaw is a classic example of Unrestricted Upload, identified as CWE-434.

The affected product is hortusfox-web, developed by Daniel Brendel, with versions through 6.3 inclusive. No later releases are noted as fixed.

The CVSS score of 7.7 indicates a high severity. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the flaw is not currently listed in the CISA KEV catalog. The attack vector requires an authenticated user session and involves a POST to /plants/attachments/add. Once a file is successfully uploaded, an attacker may immediately exploit stored XSS or attempt to execute PHP code if directory execution is not blocked, which could compromise the entire web application.