Horde vulnerabilities
We track 3 vulnerabilities in Horde products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 8, 2026.
Latest Horde vulnerabilities
- 8.8 High severity
Vfs: Improper Neutralization of Special Elements used in an OS Command
Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbi
- 7.2 High severity
IMP: Improper Neutralization of Input During Web Page Generation
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wil
- 8.0 High severity
Groupware: Use of Externally-Controlled Input to Select Classes or Code
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.