Executive brief
HortusFox, a self-hosted plant management and tracking system, contains a security vulnerability in its calendar feature. An attacker can create a calendar event with a malicious name that, when saved, executes hidden code in the browsers of other users who view the system's chat or dashboard. This could allow an attacker to hijack user sessions, steal sensitive information, or perform actions on behalf of other users, including administrators.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the 'addedCalendarItem' function within the Calendar module of hortusfox-web v4.4. The vulnerability arises because the '$name' parameter is interpolated into a localization string and subsequently passed to the 'addToChat' function without proper sanitization or output encoding. The 'addToChat' function performs a raw SQL INSERT into the database, and the malicious payload is later rendered unescaped in the chat UI. An attacker can exploit this by creating a calendar event with a malicious name (e.g., containing <script> or <img> tags with onerror attributes). When any user, including administrators, views the chat or logs in, the payload executes in their browser context, potentially leading to session hijacking or privilege escalation.
Affected products
- Daniel Brendel hortusfox-web 4.4
Timeline
- 2025-08-13: disclosed: Initial disclosure date
- 2025-08-13: advisory: NVD publication date