CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
- Record
CVE-2026-110236- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-99020
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
- Record
EUVD-2026-99020- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2mwq-hp78-h332
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows...
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
- Record
GHSA-2mwq-hp78-h332- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
- Record
CVE-2026-110236- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
- Record
CVE-2026-110236- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
- Record
DEBIAN-CVE-2026-110236- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
- Record
UBUNTU-CVE-2026-110236- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dolphinDebian:12 |
All versions, plus listed versions 4:22.12.3-14:23.08.1-14:24.05.2-14:24.08.0-14:24.08.0-2 Show 21 moreShow less4:24.08.0-34:24.08.0-44:24.08.0-54:24.12.0.1-14:24.12.0.1-24:24.12.0.1-34:24.12.1-14:24.12.1-24:24.12.2-14:24.12.2-24:25.03.90-14:25.03.90-24:25.03.90-34:25.04.0-14:25.04.2-14:25.04.3-14:25.12.1-14:25.12.3-14:26.04.0-14:26.08.0-14:26.08.2-1 |
None known |
dolphinDebian:13 |
All versions, plus listed versions 4:25.04.3-14:25.04.3-1+deb13u14:25.12.1-14:25.12.3-14:26.04.0-14:26.08.0-14:26.08.2-1 |
None known |
dolphinDebian:14 |
All versions, plus listed versions 4:25.04.3-14:25.12.1-14:25.12.3-14:26.04.0-14:26.08.0-14:26.08.2-1 |
None known |
dolphinUbuntu:16.04:LTS |
All versions, plus listed versions 4:15.08.2-0ubuntu14:15.12.1-0ubuntu14:15.12.3-0ubuntu1 |
None known |
dolphinUbuntu:18.04:LTS |
All versions, plus listed versions 4:17.04.3-0ubuntu24:17.08.3-0ubuntu14:17.12.2-0ubuntu14:17.12.3-0ubuntu1 |
None known |
dolphinUbuntu:20.04:LTS |
All versions, plus listed versions 4:19.04.3-0ubuntu14:19.04.3-0ubuntu24:19.08.1-1ubuntu14:19.08.3-0ubuntu14:19.12.0-0ubuntu14:19.12.1-0ubuntu14:19.12.2-0ubuntu14:19.12.3-0ubuntu1 |
None known |
dolphinUbuntu:22.04:LTS |
All versions, plus listed versions 4:21.08.1-1ubuntu14:21.08.3-0ubuntu14:21.11.80-0ubuntu14:21.11.90-0ubuntu24:21.12.0-0ubuntu1 Show 4 moreShow less4:21.12.1-0ubuntu14:21.12.2-0ubuntu14:21.12.2.1-0ubuntu14:21.12.3-0ubuntu1 |
None known |
dolphinUbuntu:24.04:LTS |
All versions, plus listed versions 4:23.08.1-0ubuntu14:23.08.2-0ubuntu14:23.08.3-0ubuntu14:23.08.4-0ubuntu14:23.08.5-0ubuntu14:23.08.5-0ubuntu24:23.08.5-0ubuntu34:23.08.5-0ubuntu4 |
None known |
dolphinUbuntu:26.10 |
All versions, plus listed versions 4:25.12.3-0ubuntu14:26.04.0-1ubuntu14:26.04.1-0ubuntu14:26.04.2-0ubuntu14:26.04.3-0ubuntu1 Show 5 moreShow less4:26.07.90-0ubuntu14:26.08.0-0ubuntu14:26.08.0-1ubuntu14:26.08.0-1ubuntu24:26.08.1-0ubuntu1 |
None known |
dolphinUbuntu:26.04:LTS |
All versions, plus listed versions 4:25.08.1-0ubuntu24:25.08.2-0ubuntu14:25.08.3-0ubuntu14:25.08.3-0ubuntu24:25.11.80-0ubuntu1 Show 8 moreShow less4:25.11.90-0ubuntu14:25.12.0-0ubuntu14:25.12.1-0ubuntu14:25.12.1-1ubuntu14:25.12.1-1ubuntu24:25.12.2-0ubuntu14:25.12.2-0ubuntu24:25.12.3-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-110236 is a high vulnerability (CVSS 7.1) in Kde Dolphin, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. No source names a fixed version.
References
hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJCMaGsizg
github.com/KDE/dolphin/blob/v26.08.2/src/dolphinmainwindow.cpp
vulncheck.com/advisories/kde-dolphin-24.08.0-through-26.08.2-os-command-injection-via-crafted-folder-name
nvd.nist.gov/vuln/detail/CVE-2026-110236
invent.kde.org/system/dolphin