Description (CNA)
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| KDE / Dolphin | affected 24.08.0 through 26.08.2 |
CWE
CWE-78