{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dolphin-24.08.0-26.08.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kde:dolphin:24.08.0:*:*:*:*:*:*:*","cpe:2.3:a:kde:dolphin:26.08.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-110236"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Dolphin (24.08.0-26.08.2)"],"_cs_severities":["high"],"_cs_tags":["command-injection","linux","kde"],"_cs_type":"advisory","_cs_vendors":["KDE"],"content_html":"\u003cp\u003eKDE Dolphin versions 24.08.0 through 26.08.2 are susceptible to an OS command injection vulnerability (CVE-2026-110236). The flaw exists within the slotDoubleClickViewBackground function, which fails to adequately sanitize directory names before substituting them into a path placeholder. An attacker can create a folder with a malicious name containing shell metacharacters and double quotes, designed to break out of the intended command context. When an authenticated user performs a double-click on the background of a directory view within Dolphin, the application inadvertently executes the embedded malicious commands. This vulnerability allows for arbitrary command execution under the context of the user running the Dolphin process, potentially leading to unauthorized data access or further system compromise. Users of the affected versions should update to the latest available release to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability affects users of the KDE desktop environment utilizing Dolphin as a file manager. Successful exploitation allows for arbitrary code execution with the user's privileges, which may result in data exfiltration, modification of user files, or the installation of persistent malicious payloads. The severity is marked as high due to the potential for local system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to the latest version of KDE Dolphin, which includes the fix for CVE-2026-110236.\u003c/li\u003e\n\u003cli\u003eAudit file systems for unusually named directories containing shell metacharacters (e.g., ;, |, \u0026amp;, $, `) which may indicate attempts to leverage this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T04:38:49Z","date_published":"2026-10-14T04:38:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kde-dolphin-rce/","summary":"KDE Dolphin versions 24.08.0 through 26.08.2 are vulnerable to OS command injection through improper sanitization of directory names used in the slotDoubleClickViewBackground function.","title":"OS Command Injection in KDE Dolphin via Crafted Folder Names","url":"https://feed.craftedsignal.io/briefs/2026-10-kde-dolphin-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Dolphin (24.08.0-26.08.2)","version":"https://jsonfeed.org/version/1.1"}