CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the
Published Oct 13, 2026 · updated Oct 14, 2026
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · OSV.dev
Detected
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
Oct 14, 2026 · OSV.dev
Updated
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
Affected
- Debian:12 dolphin4:22.12.3-1, 4:23.08.1-1, 4:24.05.2-1
- Debian:13 dolphin4:25.04.3-1, 4:25.04.3-1+deb13u1, 4:25.12.1-1
- Debian:14 dolphin4:25.04.3-1, 4:25.12.1-1, 4:25.12.3-1