CVE-2026-110236: KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of KDE Dolphin versions 24.08.0 through 26.08.2 are exposed when they browse a directory containing an attacker-controlled crafted folder name and double-click the view background.
What must an attacker do to trigger command execution?
The attacker must supply a directory name containing a double quote and shell metacharacters. The crafted name is substituted into the {path} placeholder, allowing it to escape quoting when the victim double-clicks the view background.
Does exploitation require the attacker to already have local privileges?
No privileges are required according to the supplied vector, but exploitation requires user interaction. A victim must double-click the Dolphin view background while in the affected directory.
How can I determine whether a system is affected?
Check the installed KDE Dolphin version. Versions from 24.08.0 through 26.08.2 are identified as affected.