CVE catalog

CVE-2026-60102

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitutio

[CVE catalog]

Severity
High · CVSS 7.7CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
3.27% · Oct 25, 2026

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-horde-vfssid2.4.2-1vulnerable
Debianphp-horde-vfsbookworm2.4.2-1vulnerable
Cpephp-horde-vfsNot reportedNot reportedvulnerable
Ubuntuphp-horde-vfs16.042.3.0-1vulnerable
Ubuntuphp-horde-vfs16.042.3.0-2vulnerable
Ubuntuphp-horde-vfs16.042.3.1-1vulnerable
Ubuntuphp-horde-vfs16.042.3.1-1ubuntu1vulnerable
Ubuntuphp-horde-vfs18.042.4.0-1vulnerable
Ubuntuphp-horde-vfs18.042.4.0-1ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-horde-vfssourcesid(unfixed)not yet assignedNot reported[1143051]
Debianphp-horde-vfssourcebookworm(unfixed)end-of-lifeNot reported[1143051]

[Debian bug #1143051]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-horde-vfs]Affected
    Details (2)

    • 2.4.2-1 · all · bookworm

      Affected

      nvd · php-horde-vfs · debian · bookworm; nvd · php-horde-vfs · debian · 12

    • 2.4.2-1 · all · bookworm

      Affected

      nvd · php-horde-vfs · debian · bookworm; nvd · php-horde-vfs · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]