CVE-2026-110236

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110236
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110236.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110236
Downstream
Published
2026-10-13T18:50:17Z
Modified
2026-10-14T10:47:00Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
Details

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110236.json"
}
References

Affected packages

Git / github.com/kde/dolphin

Affected ranges

Type
GIT
Repo
https://github.com/kde/dolphin
Events
Introduced
d9612a79bcab5e445863d6327b2774f1772534ee
Last Affected
f19f070e7dc140213a2c6dd5d11f26122c89e1a0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "24.08.0"
        },
        {
            "last_affected":  "26.08.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110236.json"