PT-2026-56520 · Horde · Horde Virtual File System Api

Hacker Fantastic · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-60102

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Horde Virtual File System (VFS) API versions prior to 3.0.1

Description The Horde Vfs Smb driver contains an OS command injection flaw where the escapeShellCommand() method does not properly sanitize command substitution sequences. Authenticated attackers can exploit this by providing malicious filenames during file upload, folder creation, rename, or deletion operations. These filenames are interpolated into a double-quoted shell context and executed via proc open() through /bin/sh -c before smbclient runs, allowing the execution of arbitrary shell commands on the underlying system.

Recommendations Update Horde Virtual File System (VFS) API to version 3.0.1 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-60102

Affected Products

Horde Virtual File System Api

References · 9

• https://github.com/horde/Vfs/commit/41f74b4acfc144e09013d04dd121e0a5da808361 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-60102 · Security Note
• https://github.com/horde/Vfs/pull/10 · Note
• https://github.com/horde/Vfs/releases/tag/v3.0.1 · Note
• https://twitter.com/CVEnew/status/2074931617697546581 · Twitter Post
• https://twitter.com/myhackerhouse/status/2074916249444798592 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074933004338647525 · Twitter Post
• https://vulncheck.com/advisories/horde-vfs-os-command-injection-via-horde-vfs-smb-driver · Note
• https://twitter.com/hackerfantastic/status/2074885923376882131 · Twitter Post