CVE-2026-110236

Awaiting Analysis Awaiting Analysis - Queue

KDE Dolphin OS Command Injection via Crafted Folder Names

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110236

EUVD

EUVD-2026-99020

Affected Vendors & Products

Vendor	Product	Version / Range
KDE	Dolphin	24.08.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

KDE Dolphin versions 24.08.0 through 26.08.2 have an OS command injection flaw. Attackers can create a folder with a malicious name containing double quotes and shell metacharacters. When a victim double-clicks the view background in Dolphin, the crafted folder name is inserted into a command via the {path} placeholder. This causes the command to execute unintended shell commands, allowing arbitrary code execution.

Detection Guidance

Check if Dolphin's custom command feature is enabled and configured to use the {path} placeholder. Inspect directories for suspicious names containing shell metacharacters or quotes. Review Dolphin's logs for unexpected command executions during background double-clicks.

Impact Analysis

If you use a vulnerable Dolphin version and have configured a custom command with the {path} placeholder, an attacker could trick you into executing arbitrary commands on your system. This could lead to data theft, malware installation, or full system compromise. The attack requires you to double-click the view background in a directory controlled by the attacker.

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using vulnerable Dolphin versions may face compliance violations if exploited, potentially resulting in legal penalties or data breach notifications.

Mitigation Strategies

Disable the custom command feature in Dolphin or avoid using the {path} placeholder. Update Dolphin to the latest patched version. Avoid opening directories from untrusted sources. Monitor for suspicious activity in system logs.

Hi! I’m here to help you understand CVE-2026-110236. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70