CVE-2021-28428

CVE-2021-28428 is a critical file upload vulnerability affecting HorizontCMS versions prior to 1.0.0-beta.3. Attackers can bypass existing PHP extension restrictions by uploading malicious .htaccess and arbitrary files with a .hello extension through the Media Files upload functionality, leading to remote code execution (RCE). With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction, potentially resulting in complete compromise of confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.