Read the docs
TI-2026-42826 Aliases CVE-2026-60102GHSA-4crx-2rrv-xxcf

Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0327 88th percentileScored 2026-11-07
Fix Fixed Vfs (horde): 3.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HordeVfsbefore 3.0.13.0.1Patch availableCNA
  • Vfs VendorHorde Affected before 3.0.1 Fixed in 3.0.1 Patch available CNA

Remediation

  • Fix · CNA Vfs (horde) Fixed in 3.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-60102
  2. 2026-10-03 Alias added: GHSA-4crx-2rrv-xxcf

References

Patch 1

Other 2

  • TI-2020-06837 Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV… CVSS 3.1CRITICAL 9.8
  • TI-2022-12524 Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack… CVSS 3.1HIGH 8.0
  • TI-2025-21655 Cross-site scripting in Horde IMP CVSS 3.1HIGH 7.2
  • TI-2012-00202 Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as… CVSS 2.0HIGH 7.5
  • TI-2017-05066 In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17… CVSS 3.0HIGH 8.8
  • TI-2014-01304 The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences