Command Injection Vulnerability in smb4k by OpenSUSE
CVE-2025-66002

6.9MEDIUM

Key Information:

Vendor

Https://github.com/kde/

Status
Smb4k
Vendor
CVE Published:
8 January 2026

What is CVE-2025-66002?

The smb4k mount helper for OpenSUSE presents a vulnerability that allows local users to exploit improper handling of argument delimiters, leading to potential arbitrary unmounts. This issue could give malicious local users the ability to affect system operations adversely by injecting commands that are improperly validated.

Affected Version(s)

smb4k ? < 4.0.5

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-66002
https://security.opensuse.org/2025/12/10/smb4k-major-issu...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthias Gerstner of SUSE
.