{"id":"CVE-2026-60102","title":"Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver","summary":"Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated a…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-78"],"vendor":"horde","product":"Vfs","affected":["Vfs < 3.0.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-07-08T17:40:35.903444Z"},"published":"2026-07-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:07:27.048Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-60102","references":[{"url":"https://github.com/horde/Vfs/releases/tag/v3.0.1","label":"Vfs 3.0.1 Release Notes"},{"url":"https://github.com/horde/Vfs/pull/10","label":"Fix PR"},{"url":"https://github.com/horde/Vfs/commit/41f74b4acfc144e09013d04dd121e0a5da808361","label":"Fix Commit"},{"url":"https://www.vulncheck.com/advisories/horde-vfs-os-command-injection-via-horde-vfs-smb-driver"}],"tags":["cve.org"],"epss":0.0327,"epssPercentile":0.88483,"ingestedAt":"2026-11-08T14:51:22.277Z","slug":"CVE-2026-60102","body":"## Overview\n\nHorde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.\n\n## Affected\n\n- `Vfs < 3.0.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.7,"exploitation":0,"ransomware":0},"changes":[]}