Fluxbox: OS command injection in RootTheme::reconfigTheme (CVE-2026-123784)
Fluxbox versions 1.3.7 and earlier are vulnerable to OS command injection via crafted style files, allowing arbitrary command execution through unsafe concatenation in the fbsetbg utility.
CVE search metadata
CVE search record: CVE-2026-123784. Severity: high. CVSS: 7.8. KEV: no. Product: Fluxbox (<= 1.3.7). Brief: Fluxbox: OS command injection in RootTheme::reconfigTheme (CVE-2026-123784). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fluxbox-rce/
Triage facts
Revision 1- Applicability
- Fluxbox (<= 1.3.7)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 17:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Fluxbox through version 1.3.7 contains an OS command injection vulnerability located within the RootTheme::reconfigTheme() function. The vulnerability is triggered when a user loads a style file containing maliciously crafted background pixmap paths, directory names, or gradient texture strings. These values are unsafely concatenated into an fbsetbg command and executed via a shell, leading to potential arbitrary command execution in the context of the user running Fluxbox.
Impact
Successful exploitation allows for arbitrary code execution with the privileges of the user running the window manager.
Recommendation
- Identify all systems running Fluxbox 1.3.7 or earlier within your environment.
- Prioritize updating to the patched version of Fluxbox as soon as it is released by the maintainers.
- Until a patch is applied, restrict access to custom style files and verify the integrity of any style configurations used by users.
Immediate actions
Inventory all Linux workstations and servers running Fluxbox to identify versions <= 1.3.7
Threat Hunt
Monitor for suspicious process spawning from fbsetbg
Data: Process lineage (e.g., auditd or eBPF)
Mitigations
Upgrade to the patched version of Fluxbox once available
CVE-2026-123784