OS Command Injection in KDE Dolphin via Crafted Folder Names

KDE Dolphin versions 24.08.0 through 26.08.2 are susceptible to an OS command injection vulnerability (CVE-2026-110236). The flaw exists within the slotDoubleClickViewBackground function, which fails to adequately sanitize directory names before substituting them into a path placeholder. An attacker can create a folder with a malicious name containing shell metacharacters and double quotes, designed to break out of the intended command context. When an authenticated user performs a double-click on the background of a directory view within Dolphin, the application inadvertently executes the embedded malicious commands. This vulnerability allows for arbitrary command execution under the context of the user running the Dolphin process, potentially leading to unauthorized data access or further system compromise. Users of the affected versions should update to the latest available release to mitigate this risk.

Impact

The vulnerability affects users of the KDE desktop environment utilizing Dolphin as a file manager. Successful exploitation allows for arbitrary code execution with the user's privileges, which may result in data exfiltration, modification of user files, or the installation of persistent malicious payloads. The severity is marked as high due to the potential for local system compromise.

Recommendation

• Update to the latest version of KDE Dolphin, which includes the fix for CVE-2026-110236.
• Audit file systems for unusually named directories containing shell metacharacters (e.g., ;, |, &, $, `) which may indicate attempts to leverage this vulnerability.