Dolphin (24.08.0-26.08.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/dolphin-24.08.0-26.08.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 14 Oct 2026 04:38:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOS Command Injection in KDE Dolphin via Crafted Folder Nameshttps://feed.craftedsignal.io/briefs/2026-10-kde-dolphin-rce/Wed, 14 Oct 2026 04:38:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kde-dolphin-rce/KDE Dolphin versions 24.08.0 through 26.08.2 are vulnerable to OS command injection through improper sanitization of directory names used in the slotDoubleClickViewBackground function.KDE Dolphin versions 24.08.0 through 26.08.2 are susceptible to an OS command injection vulnerability (CVE-2026-110236). The flaw exists within the slotDoubleClickViewBackground function, which fails to adequately sanitize directory names before substituting them into a path placeholder. An attacker can create a folder with a malicious name containing shell metacharacters and double quotes, designed to break out of the intended command context. When an authenticated user performs a double-click on the background of a directory view within Dolphin, the application inadvertently executes the embedded malicious commands. This vulnerability allows for arbitrary command execution under the context of the user running the Dolphin process, potentially leading to unauthorized data access or further system compromise. Users of the affected versions should update to the latest available release to mitigate this risk.

Impact

The vulnerability affects users of the KDE desktop environment utilizing Dolphin as a file manager. Successful exploitation allows for arbitrary code execution with the user's privileges, which may result in data exfiltration, modification of user files, or the installation of persistent malicious payloads. The severity is marked as high due to the potential for local system compromise.

Recommendation

  • Update to the latest version of KDE Dolphin, which includes the fix for CVE-2026-110236.
  • Audit file systems for unusually named directories containing shell metacharacters (e.g., ;, |, &, $, `) which may indicate attempts to leverage this vulnerability.
]]>highadvisorycommand-injectionlinuxkde