High severity7.0NVD Advisory· Published Oct 13, 2026· Updated Oct 13, 2026

CVE-2026-110236

Description

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

KDE/Dolphinllm-fuzzy
Range: 24.08.0 through 26.08.2

Patches

Vulnerability mechanics

References

github.com/KDE/dolphin/blob/v26.08.2/src/dolphinmainwindow.cppnvd
hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJCMaGsizgnvd
www.vulncheck.com/advisories/kde-dolphin-24.08.0-through-26.08.2-os-command-injection-via-crafted-folder-namenvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000