HortusFox v6.1 Better safe than sorry
This hotfix patches a minor security vulnerability in the context of importing backup archives into a workspace. A properly prepared backup .zip archive containing a .htaccess and shell script may allow an attacker to perform a remote code execution.
Please note that this vulnerability requires to trick an admin into importing a malicious backup file. Normal users, or unauthenticated users cannot abuse this security vulnerability.
This patch fixes this issue by checking the uploaded files for potentially dangerous file names and extensions.
Thanks to @lyn4r for confidently communicating about this issue per our security guidelines.