What’s Vulnerable › Vulnerabilities

CVE-2026-110236: KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-26
• Weakness: CWE-78

Description

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.

Affected products

• KDE Dolphin: from 24.08.0 through 26.08.2

References

• https://github.com/KDE/dolphin/blob/v26.08.2/src/dolphinmainwindow.cpp#L3195-L3225
• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJCMaGsizg
• https://www.vulncheck.com/advisories/kde-dolphin-24.08.0-through-26.08.2-os-command-injection-via-crafted-folder-name
• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJCMaGsizg

Get alerted when CVE-2026-110236 or the next vulnerability affects your stack