CVE-2026-60102

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-60102
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-60102.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-60102
Downstream
Published
2026-07-08T16:25:19.153Z
Modified
2026-07-16T03:32:38.188171083Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver
Details

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the HordeVfsSmb driver where the escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via procopen() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60102.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/horde/vfs

Affected ranges

Type
GIT
Repo
https://github.com/horde/vfs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
115099819c44c84bf0e4a9f37982558d606f3944
Fixed
41f74b4acfc144e09013d04dd121e0a5da808361
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.0beta1
v1.0.0rc1
v1.0.0rc2
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v2.*
v2.0.0
v2.0.0alpha1
v2.0.0beta1
v2.0.0beta2
v2.0.0rc1
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v3.*
v3.0.0
v3.0.0RC1
v3.0.0alpha4
v3.0.0alpha6
v3.0.0beta1
v3.0.0beta2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-60102.json"