HortusFox, a free and self-hosted web application for managing plants, has released version 6.2 with fixes for four medium-severity security vulnerabilities. According to the project's GitHub security advisory, the flaws involve backup and theme archive imports, SQL query handling and file extension validation. The project states that unauthenticated users cannot exploit them, because an administrator would first need to be tricked into a specific action. The maintainer nonetheless recommends that every installation be updated to 6.2.
What HortusFox does
HortusFox is released under the MIT licence and is designed to run on a server that users control. It is aimed at houseplant owners and gardening enthusiasts who want to track the care of their plants in one place. Users can record plant attributes, notes and photos, and the application includes a task system, an inventory module, a shared group chat, a calendar, a weather forecast, a theme system and a REST API.
Self-hosted tools like this appeal to people who prefer to keep their data on hardware they manage themselves rather than on a commercial cloud service. That choice also places security responsibility on the person running the software, which is why release notes that explain how an issue can be triggered matter as much as the fix itself.
Four vulnerabilities, one common thread
The 6.2 changelog lists four advisories under the identifiers GHSA-4w8p-x2jj-42w7, GHSA-8phf-v3xj-8jjg, GHSA-8rwp-2337-54mm and GHSA-pjvc-wpc6-wf73. Alongside them, the project lists a set of related fixes in a single pull request covering SQL query tokenization, attachment linking and legacy file extensions. Taken together, the work touches several areas of the application:
- Backup archive imports, which can restore a full set of application data
- Theme archive imports, which add custom visual styles to an installation
- SQL query tokenization, which governs how database queries are parsed
- Attachment linking, which connects uploaded files to records in the app
- Legacy file extension handling, which determines how older file types are validated
All four issues are rated medium severity. That rating reflects the fact that an attacker cannot simply reach in from the internet and take control. The attack depends on a trusted user performing an action that the attacker has made harmful.
Why administrator action is the key factor
According to the project's description, an attacker would need to persuade an administrator to import a prepared backup archive or a theme archive. Once the file is imported, the workspace could be compromised. This makes the attack a social engineering scenario as much as a technical one. A file that looks like a harmless theme or a routine backup could carry the payload.
The maintainer's advice is simple: never trust files from unverified sources. For administrators, that means treating any archive received from a forum, a chat message or an unfamiliar contributor as untrusted until its origin is confirmed.
Stricter checks on imported files
Version 6.2 changes how the application handles imports. According to the release notes, the software now prevents the import of potentially dangerous files. Unsafe files are also removed from imported themes, so a theme archive that contains such content is cleaned up rather than installed as-is. These are preventive measures layered on top of the specific fixes, and they reduce the damage a malicious archive could do even if a user makes a mistake.
The changes are a reminder that import features are a common point of risk in web applications. Any feature that accepts uploaded archives and writes their contents to a server deserves close scrutiny, and the HortusFox team has now tightened that path.
Other changes in version 6.2
The release is not limited to security. It adds an Italian user interface language, which is listed in the changelog as pull request 554, and it introduces three new console commands for administrators. These are product:info, migrate:email and migrate:version. The commands give operators command-line tools for tasks that would otherwise require the web interface, which can be useful for scripted deployments and maintenance work.
System requirements and installation
HortusFox 6.2 runs on PHP 8.3 or later and requires MariaDB 11.4 or later. Users who prefer containers can install it with Docker, which the project supports. Anyone upgrading an existing installation should confirm that their server meets these requirements before starting. As with any upgrade, making a fresh backup before applying the new version is a sensible precaution.
What comes next
For most users the practical step is straightforward: update to 6.2, review how backups and themes are imported, and only use archives from sources they trust. Because the vulnerabilities required administrator interaction, the immediate risk for a well-managed installation is limited. Still, medium-severity flaws in tools that store personal data and control shared spaces deserve prompt attention, and the project's position is that all workspaces should move to the new release.
Related: Pocket Circle: Free Offline Party Games for One Phone · Doory: A Free, Open-Source Alternative to Canva
Comments (0)