UBUNTU-CVE-2026-60102

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-60102

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-60102.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-60102

Upstream

CVE-2026-60102

Published

2026-07-08T17:17:00Z

Modified

2026-07-15T19:47:08.490541713Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the HordeVfsSmb driver where the escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via procopen() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.

References

Affected packages

Ubuntu:16.04:LTS / php-horde-vfs

Package

Name: php-horde-vfs
Purl: pkg:deb/ubuntu/php-horde-vfs?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.3.0-1

2.3.0-2

2.3.1-1

2.3.1-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-horde-vfs",
            "binary_version": "2.3.1-1ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-60102.json"

Ubuntu:18.04:LTS / php-horde-vfs