CVE-2026-60102
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedHorde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe Horde VFS API before 3.0.1 has an OS command injection vulnerability in the Horde_Vfs_Smb driver. The _escapeShellCommand() method fails to properly sanitize command substitution sequences (such as `$(...)` or backticks), allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames during file upload, folder creation, rename, or deletion operations. The malicious filename is interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Horde VFS API installationLocate the Horde VFS API library in your environment. Check for the presence of files such as lib/Horde/Vfs.php, Vfs/Smb.php, or a composer.json/PEAR package for the horde/vfs component. Determine the installed version by reading the version constant in the main Vfs.php file or using composer show horde/vfs.Affected if The installed version is earlier than 3.0.1 (e.g., 3.0.0, 2.x, or unversioned).
-
Verify Horde_Vfs_Smb driver is in useExamine your Horde configuration files (typically in config/ or conf/ directories) for any VFS backend configuration. Look for a 'vfs' or 'Vfs' configuration key that specifies 'smb' as the driver type. Check if the Horde_Vfs_Smb class is being instantiated or referenced.Affected if The configuration specifies 'smb' as the VFS driver, enabling the vulnerable Horde_Vfs_Smb driver.
-
Inspect the _escapeShellCommand methodLocate the Horde/Vfs/Smb.php file in your installation. Open the file and search for the _escapeShellCommand method. Examine whether the method contains logic to filter or escape command substitution characters such as $(), backticks, or other shell metacharacters.Affected if The _escapeShellCommand method lacks sanitization for $(...), backticks, or similar command substitution sequences (the fix in version 3.0.1 is not present).
You are affected if the Horde VFS API version is below 3.0.1 and the Horde_Vfs_Smb driver is configured as the VFS backend, allowing user-supplied filenames to be interpolated into shell commands without proper sanitization.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to Horde VFS API version 3.0.1 or later, which contains a proper fix for the _escapeShellCommand() method to sanitize command substitution sequences.
Upgrade to Horde VFS version 3.0.1 or later
- 1. Identify the current installed version of Horde VFS API (e.g., by checking composer.json, composer.lock, or the installed package version)
- 2. Upgrade Horde VFS to version 3.0.1 or later using Composer: `composer require horde/vfs:^3.0.1` or `composer update horde/vfs`
- 3. Verify the upgrade was successful by checking the installed version
- 4. If using a package manager other than Composer, use the equivalent upgrade command for that package manager
- 5. Test that VFS operations (particularly SMB operations) still function correctly after the upgrade
- 6. Confirm the fix by reviewing commit 41f74b4acfc144e09013d04dd121e0a5da808361 if available
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation2.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,072.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-60102 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-60102 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data