Bug#1143051: php-horde-vfs: CVE-2026-60102

Source: php-horde-vfs
Version: 2.4.2-1
Severity: grave
Tags: security upstream
Justification: user security hole
Forwarded: https://github.com/horde/Vfs/pull/10
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerability was published for php-horde-vfs.

CVE-2026-60102[0]:
| Horde Virtual File System (VFS) API before 3.0.1 contains an OS
| command injection vulnerability in the Horde_Vfs_Smb driver where
| the _escapeShellCommand() method fails to sanitize command
| substitution sequences, allowing authenticated attackers to inject
| arbitrary shell commands through user-controlled filenames.
| Attackers can supply malicious filenames containing unescaped
| command substitution payloads through operations such as file
| upload, folder creation, rename, or deletion, which are interpolated
| into a double-quoted shell context and executed via proc_open()
| through /bin/sh -c before smbclient runs, resulting in arbitrary
| command execution on the underlying system.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-60102
    https://www.cve.org/CVERecord?id=CVE-2026-60102
[1] https://github.com/horde/Vfs/pull/10
[2] https://github.com/horde/Vfs/commit/41f74b4acfc144e09013d04dd121e0a5da808361

Regards,
Salvatore