high7.0
CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names …
Impact
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
Affected products
| Product | Affected versions |
|---|---|
| KDE Dolphin 24.08.0 | through 26.08.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.