{"id":"CVE-2022-32278","details":"XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server.","modified":"2026-08-12T13:32:57.560168Z","published":"2022-06-13T22:01:38Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32278.json","cna_assigner":"mitre"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32278.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32278"},{"type":"ADVISORY","url":"https://www.debian.org/security/2022/dsa-5164"},{"type":"FIX","url":"https://gitlab.xfce.org/xfce/exo/-/commit/c71c04ff5882b2866a0d8506fb460d4ef796de9f"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00018.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.xfce.org/xfce/exo","events":[{"introduced":"0"},{"fixed":"85b7f32dbea3474a4a1d19c17cd91af1bb0a1a00"},{"introduced":"363fa0b3972e831a47454dfad89d17ed7ac2f30e"},{"fixed":"eaccbc71604af3b4a14f77daf3873654df832802"},{"fixed":"c71c04ff5882b2866a0d8506fb460d4ef796de9f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.16.4"},{"introduced":"4.17.0"},{"fixed":"4.17.2"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:xfce:exo:*:*:*:*:*:*:*:*"}}],"versions":["exo-4.16.3","exo-4.17.1","exo-4.17.0","exo-4.16.2","exo-4.16.1","exo-4.16.0","xfce-4.16pre2","exo-4.15.3","xfce-4.16pre1","exo-4.15.2","exo-4.15.1","xfce-4.14.0","exo-0.12.8","exo-0.12.11","exo-0.12.10","exo-0.12.9","xfce-4.14pre3","exo-0.12.7","xfce-4.14pre2","exo-0.12.6","xfce-4.14pre1","exo-0.12.5","exo-0.12.4","exo-0.12.3","exo-0.12.2","exo-0.12.1","exo-0.12.0","exo-0.11.5","exo-0.11.4","exo-0.11.3","exo-0.11.2","exo-0.11.1","exo-0.11.0","exo-0.10.7","exo-0.10.6","exo-0.10.5","exo-0.10.4","exo-0.10.3","exo-0.10.2","exo-0.10.1","exo-0.10.0","exo-0.9.1","exo-0.9.0","exo-0.8.0","exo-0.7.3","exo-0.7.2","exo-0.7.1","exo-0.7.0","exo-0.6.0","exo-0.5.6","exo-0.5.5","exo-0.5.4","exo-0.5.3","exo-0.5.2","exo-0.5.0","xfce-4.6.1","exo-0.3.101","xfce-4.6.0","exo-0.3.100","xfce-4.6rc1","exo-0.3.99.1","xfce-4.6beta3","exo-0.3.93","xfce-4.6beta2","exo-0.3.92","xfce-4.6beta1","exo-0.3.91","xfce-4.6alpha","exo-0.3.80","xfce-4.4.2","exo-0.3.4","xfce-4.4rc2","exo-0.3.1.12rc2","xfce-4.4rc1","exo-0.3.1.10rc1","xfce-4.4beta1","exo-0.3.1.6beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-32278.json","vanir_signatures_modified":"2026-08-12T13:32:57Z","vanir_signatures":[{"digest":{"function_hash":"65182670254996745520488544014872230155","length":1092},"id":"CVE-2022-32278-bcd63f95","signature_type":"Function","signature_version":"v1","source":"https://gitlab.xfce.org/xfce/exo@c71c04ff5882b2866a0d8506fb460d4ef796de9f","target":{"file":"exo-open/main.c","function":"exo_open_launch_desktop_file"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["317075828566434803374487862172180080712","234380134646955126268904282729473183340","75042849870077933110780251556200223641"],"threshold":0.9},"id":"CVE-2022-32278-f6634d0a","signature_type":"Line","signature_version":"v1","source":"https://gitlab.xfce.org/xfce/exo@c71c04ff5882b2866a0d8506fb460d4ef796de9f","target":{"file":"exo-open/main.c"}}]}}],"schema_version":"1.9.0"}