CVE-2026-60102: Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver
Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the HordeVfsSmb driver where the escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via procopen() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60102?
The severity of CVE-2026-60102 is high with a score of 8.8.
What is CVE-2026-60102 about?
CVE-2026-60102 is an OS command injection vulnerability in the Horde_Vfs_Smb driver that allows authenticated attackers to inject arbitrary shell commands.
How do I fix CVE-2026-60102?
To fix CVE-2026-60102, upgrade the Horde Virtual File System (VFS) to version 3.0.1 or later.
Who is affected by CVE-2026-60102?
Users of Horde Virtual File System (VFS) versions before 3.0.1 are affected by CVE-2026-60102.
What type of vulnerability is CVE-2026-60102 classified as?
CVE-2026-60102 is classified as an OS Command Injection vulnerability.