Vulnerability in PCManFM-Qt Affects File Handling Process
CVE-2026-48700

9.3CRITICAL

Key Information:

Vendor

Lxqt

Status
Pcmanfm-qt
Vendor
CVE Published:
22 May 2026

What is CVE-2026-48700?

A vulnerability exists in PCManFM-Qt versions 1.1.0 and above, where the handling of file paths passed as URIs during the org.freedesktop.FileManager1.ShowFolders D-Bus method call allows the program to delegate actions to other applications without user confirmation. This could potentially lead to unauthorized code execution or bypassing network namespace restrictions. While this behavior technically aligns with existing specifications, it presents usability concerns as it may enable unintended actions that could compromise user security.

Affected Version(s)

PCManFM-Qt Linux 1.1.0 <= 2.4.0

References

https://www.openwall.com/lists/oss-security/2026/05/20/2
https://www.openwall.com/lists/oss-security/2026/05/19/1
https://github.com/lxqt/pcmanfm-qt/releases

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.