Horde VFS CVE-2026-60102

Exploitation requires (1) a Horde deployment configured to use the Horde_Vfs_Smb (SMB/CIFS) VFS driver - the non-default backend that invokes smbclient through /bin/sh -c, and (2) a valid low-privileged authenticated account able to perform VFS operations (file upload, folder creation, rename, or deletion). The attacker controls the filename, which must contain shell command-substitution sequences (backticks or $(...)) that survive _escapeShellCommand() and are interpolated into a double-quoted shell context. Limiting factors: authentication is mandatory (PR:L, so anonymous/unauthenticated attackers cannot exploit it), and instances not using the SMB driver are not exploitable regardless of version, which sharply narrows the realistically vulnerable population.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity flaw that requires low-privilege authentication and carries an attack requirement (AT:P) - reflecting that the deployment must actually use the SMB VFS backend. Full high impact to confidentiality, integrity, and availability is justified because successful exploitation yields arbitrary command execution as the web/PHP service account. Against that, exploitation is gated by two real conditions: the attacker needs a valid low-privileged Horde account (PR:L), and the instance must be configured with the Horde_Vfs_Smb driver, which is not the default backend for most Horde deployments. No EPSS score, SSVC decision, or KEV listing is present in the provided data, and no public PoC is indicated - so despite the credible technical severity, current evidence points to potential rather than demonstrated exploitation. Net: a genuine high-priority issue for any Horde instance that enables the SMB VFS driver, but lower urgency for the majority of deployments that do not. Note the source score is expressed in CVSS 4.0 only; no CVSS 3.1 vector was supplied, so cross-version comparison relies on the independent assessment below.

An attacker with an ordinary authenticated Horde account uploads a file or creates a folder whose name embeds a command-substitution payload such as a backtick or $(...) sequence. When the SMB VFS driver builds the smbclient command line, the payload is evaluated by /bin/sh -c and runs on the server with the privileges of the PHP/web process, giving the attacker arbitrary command execution. No public PoC is indicated, but the low attack complexity means a working exploit would be straightforward to develop.