{
  "original_root_cause": "Horde_Vfs_Smb assembled user-controlled filenames and paths into a single shell command string and passed it to proc_open(), which invoked /bin/sh -c. The _escapeShellCommand() helper only escaped ';' and '\\', leaving $(...), backticks, quotes, and other shell metacharacters active.",
  "original_sink": "Horde_Vfs_Smb::_command() -> _execute() -> proc_open() with a shell string in lib/Horde/Vfs/Smb.php",
  "variant_triggers": [
    {
      "method": "Horde_Vfs_Smb::createFolder()",
      "input": "filename",
      "why_same_root_cause": "Builds the same smbclient -c shell string and reaches the same proc_open() sink."
    },
    {
      "method": "Horde_Vfs_Smb::deleteFile()",
      "input": "filename",
      "why_same_root_cause": "Builds 'del \"<name>\"' inside the same shell string."
    },
    {
      "method": "Horde_Vfs_Smb::writeData() / write()",
      "input": "destination filename",
      "why_same_root_cause": "Builds 'put \"<tmp>\" \"<name>\"' inside the same shell string."
    },
    {
      "method": "Horde_Vfs_Smb::rename()",
      "input": "new filename",
      "why_same_root_cause": "Builds 'rename \"<old>\" \"<new>\"' inside the same shell string."
    },
    {
      "method": "Horde_Vfs_Smb::readFile()",
      "input": "filename",
      "why_same_root_cause": "Builds 'get \"<name>\" <local>' inside the same shell string."
    },
    {
      "method": "Horde_Vfs_Smb::deleteFolder()",
      "input": "folder name",
      "why_same_root_cause": "Builds 'rmdir \"<name>\"' inside the same shell string."
    },
    {
      "method": "Horde_Vfs_Smb::isFolder()",
      "input": "name (becomes part of -D path)",
      "why_same_root_cause": "Reaches _command() with the same shell-string -D quoting."
    },
    {
      "method": "Horde_Vfs_Smb::listFolder()",
      "input": "path (becomes -D argument)",
      "why_same_root_cause": "Reaches _command() with the same shell-string -D quoting."
    }
  ],
  "fix_neutralizes_variants": "Commit 41f74b4 removes the shell-string path entirely by passing an argv array to proc_open() and escaping only the smbclient -c mini-language characters. Every variant trigger is therefore neutralized without a per-method patch."
}