CVE-2026-85082: Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames
Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker needs to cause Root Browser Classic to process a selected SQLite database whose filename or path is crafted to inject operating-system shell commands.
Are users without elevated device access likely to be exposed?
The provided information identifies the affected application as Root Browser Classic, but does not state whether exploitation requires root access, how a crafted database is delivered, or whether the vulnerable behavior is reachable in the default configuration.
How can I check whether this affects my installation?
Check whether Maple Media Root Browser Classic version 3.3.0 is installed and whether it is used to select or browse SQLite database files. The issue is triggered when the application passes a selected database path to an operating-system shell without safely handling the filename.