Executive brief
The Horde Virtual File System (VFS) library, used by the Horde Groupware suite to manage file storage, contains a security flaw in its SMB (Windows file sharing) driver. An authenticated user can execute malicious commands on the server by providing specially crafted filenames during common tasks like uploading files or creating folders. This could allow an attacker to take complete control of the server, access sensitive data, or disrupt business operations.
Technical details
An OS command injection vulnerability exists in the Horde_Vfs_Smb driver of the Horde Virtual File System (VFS) API before version 3.0.1. The root cause is the `_escapeShellCommand()` method's failure to sanitize command substitution sequences (e.g., `$(...)` or backticks) in user-provided filenames. When performing operations like file uploads, folder creation, or renaming, these malicious filenames are interpolated into a double-quoted shell context and executed via `proc_open()` through `/bin/sh -c` before `smbclient` runs. An authenticated attacker can leverage this to achieve arbitrary code execution on the underlying host. The issue has been patched in version 3.0.1 by migrating to direct `execvp()` calls and improved argument quoting.
Affected products
- Horde Vfs < 3.0.1
Timeline
- 2026-07-08: disclosed
- 2026-07-08: patched: Fixed in version 3.0.1
- 2026-07-08: advisory