PT-2025-33052 · Unknown · Hortusfox-Web

Published 2025-08-13 · Updated 2025-08-15 · CVE-2025-45317

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: hortusfox-web version 4.4

Description: A zip slip vulnerability exists in the /modules/ImportModule.php component. This allows attackers to execute arbitrary code by using a crafted archive.

Recommendations: Update to a newer version that addresses this issue. As a temporary workaround, consider restricting or disabling the use of the /modules/ImportModule.php component until a patch is available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-45317

Affected Products

Hortusfox-Web

References · 8

• 🔥 https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-45317/CVE-2025-45317.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-45317 · Security Note
• https://osv.dev/vulnerability/CVE-2025-45317 · Vendor Advisory
• https://github.com/danielbrendel/hortusfox-web/blob/8ab851101a62d8eb311235c118eeeb32a9b36978/app/modules/ImportModule.php#L28 · Note
• https://twitter.com/CVEnew/status/1955686461740552305 · Twitter Post
• https://t.me/CVEtracker/29904 · Telegram Post
• https://t.me/cveNotify/132539 · Telegram Post
• https://t.me/cveNotify/132157 · Telegram Post