Fluxbox - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/fluxbox/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 17:26:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFluxbox: OS command injection in RootTheme::reconfigTheme (CVE-2026-123784)https://feed.craftedsignal.io/briefs/2026-11-fluxbox-rce/Fri, 06 Nov 2026 17:26:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fluxbox-rce/Fluxbox versions 1.3.7 and earlier are vulnerable to OS command injection via crafted style files, allowing arbitrary command execution through unsafe concatenation in the fbsetbg utility.Fluxbox through version 1.3.7 contains an OS command injection vulnerability located within the RootTheme::reconfigTheme() function. The vulnerability is triggered when a user loads a style file containing maliciously crafted background pixmap paths, directory names, or gradient texture strings. These values are unsafely concatenated into an fbsetbg command and executed via a shell, leading to potential arbitrary command execution in the context of the user running Fluxbox.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the user running the window manager.

Recommendation

  • Identify all systems running Fluxbox 1.3.7 or earlier within your environment.
  • Prioritize updating to the patched version of Fluxbox as soon as it is released by the maintainers.
  • Until a patch is applied, restrict access to custom style files and verify the integrity of any style configurations used by users.
]]>highadvisoryvulnerabilityremote-code-executionlinux