CVE-2025-49091
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports...
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
- Record
CVE-2025-49091- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-670
- Updated
- 2026-11-02
EUVDEUVD-2025-18073
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
- Record
EUVD-2025-18073- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h4f3-5vvh-xjgj
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports...
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
- Record
GHSA-h4f3-5vvh-xjgj- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-670
- Updated
- 2026-11-02
NVD
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
- Record
CVE-2025-49091- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-670
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-49091
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
- Record
DEBIAN-CVE-2025-49091- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2025:12346
Red Hat Security Advisory: konsole security update
- Record
RHSA-2025:12346- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2025-49091
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
- Record
UBUNTU-CVE-2025-49091- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSV No score
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
- Record
CVE-2025-49091- Updated
- 2026-11-02
OSVMGASA-2025-0308 No score
Updated konsole packages fix security vulnerability
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code. (CVE-2025-49091)
- Record
MGASA-2025-0308- Updated
- 2026-11-02
OSVUSN-8752-1 No score
konsole vulnerability
It was discovered that Konsole incorrectly handled certain URLs under specific circumstances. A remote attacker could possibly use this issue to execute arbitrary code.
- Record
USN-8752-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
konsoleDebian:12 |
before 4:22.12.3-1+deb12u1, plus listed versions 4:22.12.3-1 |
4:22.12.3-1+deb12u1 |
konsoleDebian:13 |
before 4:25.04.0-2 | 4:25.04.0-2 |
konsoleDebian:14 |
before 4:25.04.0-2 | 4:25.04.0-2 |
konsoleDebian:11 |
before 4:20.12.3-1+deb11u1, plus listed versions 4:20.12.3-1 |
4:20.12.3-1+deb11u1 |
konsoleMageia:9 |
before 23.04.3-1.2.mga9 | 23.04.3-1.2.mga9 |
konsoleRed Hat:rhel_els:7 |
before 0:4.10.5-5.el7_9.1 | 0:4.10.5-5.el7_9.1 |
konsole-debuginfoRed Hat:rhel_els:7 |
before 0:4.10.5-5.el7_9.1 | 0:4.10.5-5.el7_9.1 |
konsole-partRed Hat:rhel_els:7 |
before 0:4.10.5-5.el7_9.1 | 0:4.10.5-5.el7_9.1 |
konsoleUbuntu:Pro:16.04:LTS |
before 4:15.12.3-0ubuntu1+esm1, plus listed versions 4:15.08.2-0ubuntu24:15.12.1-1ubuntu14:15.12.3-0ubuntu1 |
4:15.12.3-0ubuntu1+esm1 |
konsoleUbuntu:Pro:18.04:LTS |
before 4:17.12.3-1ubuntu1+esm1, plus listed versions 4:17.04.3-0ubuntu14:17.08.3-0ubuntu14:17.12.2-0ubuntu14:17.12.3-0ubuntu14:17.12.3-1ubuntu1 |
4:17.12.3-1ubuntu1+esm1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
konsoleUbuntu:Pro:20.04:LTS |
before 4:19.12.3-0ubuntu1+esm1, plus listed versions 4:19.04.3-0ubuntu14:19.08.2-0ubuntu14:19.08.3-0ubuntu14:19.12.0-0ubuntu14:19.12.1-0ubuntu14:19.12.2-0ubuntu14:19.12.3-0ubuntu1 |
4:19.12.3-0ubuntu1+esm1 |
konsoleUbuntu:Pro:22.04:LTS |
before 4:21.12.3-0ubuntu1+esm1, plus listed versions 4:21.08.1-1ubuntu14:21.08.2-14:21.08.3-0ubuntu14:21.11.80-0ubuntu14:21.11.90-0ubuntu2 Show 5 moreShow less4:21.12.0-0ubuntu14:21.12.0-0ubuntu24:21.12.1-0ubuntu14:21.12.2-0ubuntu14:21.12.3-0ubuntu1 |
4:21.12.3-0ubuntu1+esm1 |
konsoleUbuntu:Pro:24.04:LTS |
before 4:23.08.5-0ubuntu4+esm1, plus listed versions 4:23.08.1-0ubuntu14:23.08.2-0ubuntu14:23.08.3-0ubuntu14:23.08.4-0ubuntu14:23.08.4-0ubuntu2 Show 4 moreShow less4:23.08.5-0ubuntu14:23.08.5-0ubuntu24:23.08.5-0ubuntu34:23.08.5-0ubuntu4 |
4:23.08.5-0ubuntu4+esm1 |
konsoleUbuntu:25.10 |
All versions, plus listed versions 4:24.12.3-0ubuntu14:25.04.0-0ubuntu14:25.04.1-0ubuntu14:25.04.2-0ubuntu14:25.04.2-1ubuntu1 Show 5 moreShow less4:25.04.3-0ubuntu14:25.07.80-0ubuntu14:25.07.90-0ubuntu14:25.08.0-0ubuntu14:25.08.1-0ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | thefreestyleresearcher/CVE-2025-49091-Gajim-RCE | 2026-07-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49091 is a high vulnerability (CVSS 8.2) in Kde Konsole, published June 11, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in konsole 4:22.12.3-1+deb12u1.
References
invent.kde.org/utilities/konsole/-/tags
konsole.kde.org/changelog.html
openwall.com/lists/oss-security/2025/06/10/5
kde.org/info/security/advisory-20250609-1.txt
proofnet.de/publikationen/konsole_rce.html
Show 15 moreShow less
lists.debian.org/debian-lts-announce/2025/06/msg00019.html
nvd.nist.gov/vuln/detail/CVE-2025-49091
github.com/advisories/GHSA-h4f3-5vvh-xjgj
security-tracker.debian.org/tracker/CVE-2025-49091
advisories.mageia.org/MGASA-2025-0308.html
bugs.mageia.org/show_bug.cgi?id=34364
access.redhat.com/errata/RHSA-2025:12346
bugzilla.redhat.com/show_bug.cgi?id=2371635
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12346.json
cve.org/CVERecord?id=CVE-2025-49091
ubuntu.com/security/CVE-2025-49091