The vulnerability is an OS command injection flaw in the Horde_Vfs_Smb driver of Horde VFS before version 3.0.1. The _escapeShellCommand() method fails to strip command substitution sequences from filenames, allowing an attacker who can provide a filename to inject arbitrary shell commands. The malicious filename is incorporated into a double‑quoted shell command that is executed by proc_open() with /bin/sh -c before calling smbclient, resulting in code execution with the privileges of the PHP process. This flaw permits an authenticated attacker to run arbitrary commands on the underlying host and can lead to full system compromise.

All installations of Horde VFS older than 3.0.1 that use the SMB driver are affected. The flaw is triggered when an authenticated user performs operations such as file upload, folder creation, rename, or deletion on the SMB share.

The CVSS score of 7.7 indicates high severity, and the EPSS score of 2% suggests a modest likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. An attacker requires valid SMB credentials and the ability to create or manipulate filenames on the shared resource. Because the flaw is triggered by user-controlled filenames, an attacker with a standard SMB account can exercise the vulnerability without additional privileges.