DEBIAN-CVE-2026-60102

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-60102

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-60102.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-60102

Upstream

CVE-2026-60102

Published

2026-07-08T17:17:28.997Z

Modified

2026-07-12T04:00:15.928663931Z

Severity

7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the HordeVfsSmb driver where the escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via procopen() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.

References

https://security-tracker.debian.org/tracker/CVE-2026-60102

Affected packages

Debian:11 / php-horde-vfs

Package

Name: php-horde-vfs
Purl: pkg:deb/debian/php-horde-vfs?arch=source&distro=bullseye

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.4.1-2

2.4.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-60102.json"

Debian:12 / php-horde-vfs