CVE-2026-110236 in Dolphin
Summary
by MITRE • 10/13/2026
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified within KDE Dolphin versions 24.08.0 through 26.08.2 represents a critical OS command injection flaw rooted in improper neutralization of special elements used in an operating system command, commonly categorized under CWE-78. This security defect arises from the application's handling of file paths during user interaction with the graphical interface, specifically within the slotDoubleClickViewBackground function. The core technical failure lies in the substitution mechanism where folder names are directly inserted into a {path} placeholder without adequate sanitization or escaping of shell metacharacters. When an attacker creates a directory name containing specific crafted strings, such as double quotes combined with shell operators like semicolons, pipes, or backticks, these characters can break out of the intended command context. This allows arbitrary operating system commands to be executed by the Dolphin process under the privileges of the user who launched the application.
The operational impact of this vulnerability is significant because it leverages a common and intuitive user action: double-clicking on an empty area or background within the file manager view. Unlike vulnerabilities that require opening specific files, which might trigger additional security checks or sandbox restrictions, interacting with the view background is a low-friction interaction that users perform frequently. By embedding malicious characters in a directory name located in a reachable path, an attacker can trick a victim into executing arbitrary code simply by navigating to the folder and double-clicking the empty space within Dolphin's window. This effectively bypasses many traditional defenses because the execution originates from a trusted application running with user-level permissions, potentially leading to unauthorized access, data exfiltration, or further lateral movement if combined with other local privilege escalation techniques.
From an offensive security perspective, this vulnerability aligns closely with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques such as Unix Shell (T1059.004). The attack vector relies on the manipulation of input data to influence command execution flow, a classic pattern in injection attacks. The lack of proper context-aware encoding means that special characters intended for structural purposes within shell commands are interpreted literally by the underlying operating system interpreter rather than being treated as part of the file path string. This failure highlights a common pitfall in desktop application development where security assumptions about user input validity are not rigorously enforced during dynamic command construction.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to apply vendor-provided patches that update KDE Dolphin to versions newer than 26.08.2, which should include fixes for the slotDoubleClickViewBackground function to properly escape or quote path arguments before passing them to system commands. In environments where patching is not immediately feasible, administrators can implement file integrity monitoring solutions such as AIDE or Tripwire to detect the creation of directories with suspicious naming patterns containing shell metacharacters in user-accessible locations. Additionally, restricting the execution permissions on certain high-risk binaries via AppArmor or SELinux policies can limit the blast radius if an injection attempt succeeds. Developers should also adopt secure coding practices that mandate strict input validation and use safe API calls for command execution rather than relying on string concatenation with shell interpreters to prevent similar class of vulnerabilities in future releases.