EUVD-2026-42340
GHSA-4crx-2rrv-xxcf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires the non-default SMB VFS driver to be configured (AC:H) plus a low-privileged authenticated account (PR:L); shell command execution yields full C/I/A impact with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.
AnalysisAI
OS command injection in the Horde_Vfs_Smb driver of the Horde Virtual File System (VFS) API before 3.0.1 lets authenticated users execute arbitrary shell commands on the server. The flawed _escapeShellCommand() method fails to neutralize shell command-substitution sequences, so attacker-controlled filenames passed through routine file operations are interpolated into a double-quoted /bin/sh -c context and executed via proc_open() before smbclient runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch (v3.0.1) exists and the CVSS 4.0 base score is 7.7 (High).
Technical ContextAI
Horde VFS is a PHP storage-abstraction library used by the Horde groupware/webmail framework to read and write files across pluggable backends. The affected Horde_Vfs_Smb driver shells out to the external smbclient binary to talk to SMB/CIFS shares, building command lines that embed user-supplied filenames. Its _escapeShellCommand() sanitizer is intended to make these safe but does not escape command-substitution constructs (backticks and $(...)), which remain active inside the double-quoted argument that /bin/sh -c evaluates. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) root cause: an incomplete sanitizer combined with invocation through a shell interpreter (proc_open with /bin/sh -c) rather than a direct argv exec. The single affected CPE is cpe:2.3:a:horde:vfs:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: upgrade the Horde_Vfs component to v3.0.1 or later (https://github.com/horde/Vfs/releases/tag/v3.0.1), which corrects _escapeShellCommand() as shown in commit 41f74b4acfc144e09013d04dd121e0a5da808361 and PR #10. If you cannot upgrade immediately, switch the VFS backend away from the Horde_Vfs_Smb (SMB/CIFS) driver to a non-shell backend such as SQL or direct filesystem storage, which removes the smbclient shell invocation entirely at the cost of losing SMB share integration; where SMB storage is mandatory, restrict VFS-capable operations (upload, folder create, rename, delete) to trusted authenticated users and tighten account provisioning so untrusted users cannot obtain the low-privilege access the exploit needs. Because the flaw is a shell-interpolation issue, disabling the SMB driver is the only fully effective workaround short of patching; input-level filtering of filenames is fragile against command-substitution encodings and should not be relied upon. See the VulnCheck advisory (https://www.vulncheck.com/advisories/horde-vfs-os-command-injection-via-horde-vfs-smb-driver) for details.
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to c
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execu
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Rated high severity (CVSS 8.8), this
The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated
A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilize
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instan
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur i
Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Hor
This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmai
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webma
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today