OS Command Injection in KDE Dolphin Affects Multiple Versions
CVE-2026-110236

7.1HIGH

Key Information:

Vendor

Kde

Status
Dolphin
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110236?

KDE Dolphin versions 24.08.0 through 26.08.2 are affected by an OS command injection flaw that allows attackers to execute arbitrary commands. This vulnerability arises when crafted folder names are processed, permitting attackers to insert special characters and escape quoting sequences, particularly when users interact with the view background via double-click actions. Proper input validation measures are essential to mitigate the risks associated with this vulnerability.

Affected Version(s)

Dolphin 24.08.0 <= 26.08.2

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJCMaGsizg
third-party-advisory
https://github.com/KDE/dolphin/blob/v26.08.2/src/dolphinm...
technical-description
https://www.vulncheck.com/advisories/kde-dolphin-24.08.0-...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.