CVE-2026-60102 is an OS command injection vulnerability in the Horde Vfs product, specifically in the Horde_Vfs_Smb driver before version 3.0.1. The vulnerability occurs because the _escapeShellCommand() method fails to neutralize command substitution sequences in filenames. When an attacker supplies a filename containing unescaped shell command payloads during file operations such as upload, rename, or deletion, these payloads are interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs. This allows an authenticated attacker to execute arbitrary commands on the host system.

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands on the underlying system hosting the Horde Vfs service. This can lead to system compromise, data manipulation, or further attacks depending on the privileges of the Horde process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and avoid using untrusted filenames in file operations. Monitor for updates from the Horde project regarding patches or official mitigations.