[ CVE-2026-110236 · Published 13 Oct 2026 ]
Vulnerability in KDE Dolphin
CVSS 7.0
EPSS 1%No fix listed yet
[ Description ]Official description
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.