Vifm Command Injection via IPC FIFO

Executive Summary

CVE-2026-110237 affects Vifm versions 0.8.1-beta through 0.14.4. It allows local attackers to execute commands as another user by exploiting an unverified IPC FIFO in the shared temporary directory. Attackers pre-create a world-writable FIFO named 'vifm-ipc-vifm' and inject IPC packets containing shell commands (-c or !) that execute with the victim's privileges.

Useful 0 Not Useful 0

Detection Guidance

• Check for the existence of a world-writable FIFO named vifm-ipc-vifm in /tmp or shared temporary directories using: ls -la /tmp/vifm-ipc-vifm
• Monitor for unexpected command execution by vifm users by reviewing system logs for vifm-related processes or commands.
• Inspect vifm processes for unusual IPC activity using: ps aux | grep vifm or lsof -p <vifm_pid> | grep FIFO

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables local privilege escalation on shared systems. An attacker could gain unauthorized access to files, execute arbitrary commands, or escalate privileges to the victim's user account. It poses a risk in multi-user environments where temporary directories are shared.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized modifications, or disclosure of protected health information, potentially leading to regulatory penalties and loss of compliance.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade vifm to the latest version (0.14.4 or later) to address the IPC FIFO ownership issue.
• Remove any pre-existing vifm-ipc-vifm FIFO files in shared temporary directories like /tmp.
• Restrict write permissions on temporary directories to prevent unauthorized FIFO creation.
• Use private per-user runtime directories for vifm IPC to isolate processes.

Useful 0 Not Useful 0