The Horde Virtual File System (VFS) API prior to version 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver. The vulnerability is due to improper sanitization in the _escapeShellCommand() method, which fails to escape command substitution sequences in filenames. This allows authenticated users to inject arbitrary shell commands via filenames used in operations such as file upload, folder creation, rename, or deletion. These filenames are interpolated into a double-quoted shell context and executed through proc_open() with /bin/sh -c before smbclient runs, enabling command execution on the host system.

An authenticated attacker can execute arbitrary shell commands on the underlying system by injecting malicious payloads in filenames processed by the vulnerable Horde_Vfs_Smb driver. This can lead to full system compromise depending on the privileges of the Horde process. The vulnerability affects the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to authenticated users and avoid using vulnerable versions of the Horde VFS API. Monitor for updates from the vendor regarding an official fix.