UBUNTU-CVE-2026-123784: Command Injection
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the vulnerability?
The attacker must cause a crafted Fluxbox style to load. The malicious content can be placed in background pixmap paths, random directories, or gradient texture text using shell metacharacters.
How is command execution reached?
Fluxbox concatenates affected style background values into an fbsetbg command without escaping them, then runs that command through $SHELL -c. Shell metacharacters in those values can therefore be interpreted as commands.
Which Fluxbox versions are affected?
The issue is reported in Fluxbox through version 1.3.7. The provided information does not identify a fixed version.