Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-60102: Horde VFS SMB Driver: Malicious File Names Can Execute Commands
CVE-2026-60102
CVE-2026-60102
Summary
The Horde VFS SMB driver allows attackers to execute arbitrary system commands by uploading or renaming files with specially crafted names. This can happen when a user with legitimate access to the system uploads a file or renames a folder. To fix this issue, update Horde VFS to version 3.0.1 or later.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| horde | vfs | < 3.0.1 |
Original title
Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitu...
Original description
Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.
nvd CVSS3.1
8.8
nvd CVSS4.0
7.7
Vulnerability type
CWE-78
OS Command Injection
Published: 8 Jul 2026 · Updated: 23 Jul 2026 · First seen: 8 Jul 2026