{"id":"DEBIAN-CVE-2026-110236","details":"KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.","modified":"2026-10-14T17:02:26.685372672Z","published":"2026-10-13T19:18:48.770Z","upstream":["CVE-2026-110236"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-110236"}],"affected":[{"package":{"name":"dolphin","ecosystem":"Debian:12","purl":"pkg:deb/debian/dolphin?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:22.12.3-1","4:23.08.1-1","4:24.05.2-1","4:24.08.0-1","4:24.08.0-2","4:24.08.0-3","4:24.08.0-4","4:24.08.0-5","4:24.12.0.1-1","4:24.12.0.1-2","4:24.12.0.1-3","4:24.12.1-1","4:24.12.1-2","4:24.12.2-1","4:24.12.2-2","4:25.03.90-1","4:25.03.90-2","4:25.03.90-3","4:25.04.0-1","4:25.04.2-1","4:25.04.3-1","4:25.12.1-1","4:25.12.3-1","4:26.04.0-1","4:26.08.0-1","4:26.08.2-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110236.json"}},{"package":{"name":"dolphin","ecosystem":"Debian:13","purl":"pkg:deb/debian/dolphin?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.04.3-1","4:25.04.3-1+deb13u1","4:25.12.1-1","4:25.12.3-1","4:26.04.0-1","4:26.08.0-1","4:26.08.2-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110236.json"}},{"package":{"name":"dolphin","ecosystem":"Debian:14","purl":"pkg:deb/debian/dolphin?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.04.3-1","4:25.12.1-1","4:25.12.3-1","4:26.04.0-1","4:26.08.0-1","4:26.08.2-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110236.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}