CVE-2026-110237: Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running affected Vifm versions on systems where another local user can create entries in the shared temporary directory are exposed. Exploitation results in commands running with the privileges of the Vifm user.
What does an attacker need to exploit it?
The attacker needs local access and the ability to pre-create the world-writable vifm-ipc-vifm FIFO in the shared temporary directory. They can then send IPC packets containing -c and ! shell commands.
Does exploitation require the victim to do anything?
Yes. The supplied vector includes user interaction (UI:R), and the vulnerable behavior occurs when Vifm reuses the attacker-created FIFO. No remote access is indicated.
How can I determine whether a system may be affected?
Check whether Vifm is version 0.8.1-beta through 0.14.4 and inspect the shared temporary directory for a pre-existing vifm-ipc-vifm FIFO. In particular, a FIFO not owned by the user running Vifm is a relevant indicator of attempted or potential exploitation.