Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

All statuses
Filter by:
With package: linuxKernel.packages.linux_zen.nullfsvfs

Found 1 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-60102
7.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 1 month, 3 weeks ago Activity log
  • Created suggestion 1 month, 3 weeks ago
Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution payloads through operations such as file upload, folder creation, rename, or deletion, which are interpolated into a double-quoted shell context and executed via proc_open() through /bin/sh -c before smbclient runs, resulting in arbitrary command execution on the underlying system.

Affected products

Vfs
  • <3.0.1

Matching in nixpkgs

pkgs.avfs

Virtual filesystem that allows browsing of compressed files

  • nixos-unstable -
    • nixos-unstable-small 1.3.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.0

pkgs.gvfs

Virtual Filesystem support library (full GNOME support)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.envfs

Fuse filesystem that returns symlinks to executables based on the PATH of the requesting process

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.1.0

pkgs.mvfst

Implementation of the QUIC transport protocol

pkgs.davfs2

Mount WebDAV shares like a typical filesystem

  • nixos-unstable -
    • nixos-unstable-small 1.7.3
  • nixos-26.05 -
    • nixos-26.05-small 1.7.3

pkgs.gnome.gvfs

Virtual Filesystem support library (full GNOME support)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.linuxPackages.nullfs

Virtual black hole file system that behaves like /dev/null

  • nixos-unstable -
    • nixos-unstable-small 0.26
  • nixos-26.05 -
    • nixos-26.05-small 0.26

pkgs.linuxPackages.nullfsvfs

Virtual black hole file system that behaves like /dev/null

  • nixos-unstable -
    • nixos-unstable-small 0.26
  • nixos-26.05 -
    • nixos-26.05-small 0.26

pkgs.linuxPackages_zen.nullfs

Virtual black hole file system that behaves like /dev/null

  • nixos-unstable -
    • nixos-unstable-small 0.26
  • nixos-26.05 -
    • nixos-26.05-small 0.26

Package maintainers