CVE-2026-60102 Details
Description
Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.
A command injection vulnerability has been identified in the Horde Virtual File System (VFS) API, specifically in versions prior to 3.0.1. The issue resides within the Horde_Vfs_Smb driver, where the _escapeShellCommand() method inadequately sanitizes command substitution sequences. This flaw enables authenticated attackers to inject arbitrary shell commands by exploiting user-controlled filenames. Malicious filenames can be introduced through various operations such as file uploads, folder creations, renames, or deletions. These filenames are then interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c, before the smbclient command is executed, leading to unauthorized command execution on the underlying system.
Users can update to Horde VFS version 3.0.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/horde/Vfs/commit/41f74b4acfc144e09013d04dd121e0a5da808361 | [email protected] | Source CodeVendor |
| https://github.com/horde/Vfs/pull/10 | [email protected] | Issue TrackingVendor |
| https://github.com/horde/Vfs/releases/tag/v3.0.1 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/horde-vfs-os-command-injection-via-horde-vfs-smb-driver | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Horde Virtual File System | < 3.0.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |