{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/vifm/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vifm:vifm:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-110237"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vifm (0.8.1-beta through 0.14.4)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","linux","macos","ipc"],"_cs_type":"advisory","_cs_vendors":["Vifm"],"content_html":"\u003cp\u003eVifm, a file manager for Unix-like systems, contains a local privilege escalation vulnerability (CVE-2026-110237) affecting versions 0.8.1-beta through 0.14.4. The vulnerability stems from the application's insecure handling of Inter-Process Communication (IPC) via First-In, First-Out (FIFO) pipes. Specifically, Vifm attempts to use a FIFO file located in a shared temporary directory without verifying the ownership or permissions of that file.\u003c/p\u003e\n\u003cp\u003eA local attacker with access to the same shared directory can pre-create a FIFO named 'vifm-ipc-vifm'. When a victim user launches Vifm, the application connects to this attacker-controlled pipe. The attacker can then inject IPC packets containing the '-c' flag and '!shell' commands, which are subsequently executed by the Vifm process under the victim's security context. This allows an attacker to escalate privileges to match the victim user's session, which is particularly critical if a more privileged user or administrator executes Vifm in a directory where a lower-privileged user has created the malicious pipe.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local attacker to execute arbitrary commands with the privileges of any user who subsequently launches the vulnerable version of Vifm. This can lead to full account takeover or unauthorized access to the victim's files and environment. The impact is significant for multi-user Linux or macOS systems where Vifm is used by administrative personnel.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Vifm to a patched version once released by the maintainers; monitor the Vifm project repositories for the official fix.\u003c/li\u003e\n\u003cli\u003eImplement local monitoring for the creation of FIFO files in world-writable directories like '/tmp' or '/var/tmp' that match the naming pattern 'vifm-ipc-vifm'.\u003c/li\u003e\n\u003cli\u003eRestrict write access to shared temporary directories where possible or enforce the use of private temporary directories for individual users to prevent malicious pipe pre-creation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-14T04:38:56Z","date_published":"2026-10-14T04:38:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vifm-fifo-privesc/","summary":"Vifm versions 0.8.1-beta through 0.14.4 are vulnerable to local command injection and privilege escalation due to insecure IPC FIFO reuse in shared temporary directories.","title":"Vifm Local Privilege Escalation via Insecure IPC FIFO","url":"https://feed.craftedsignal.io/briefs/2026-10-vifm-fifo-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Vifm","version":"https://jsonfeed.org/version/1.1"}