{"schema":"threatline.record/2","record":{"id":"CVE-2026-110236","aliases":[],"summary":"KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name","details":"KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.","categories":["Unclassified"],"product":"Dolphin","vendor":"KDE","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110236","source_modified_at":"2026-10-13T18:50:17.460Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Dolphin","vendor":"KDE","versions":[{"version":"24.08.0","lessThanOrEqual":"26.08.2","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.01022,"percentile":0.6318,"score_date":"2026-10-23"},"published_at":"2026-10-13T18:50:17.460Z","modified_at":"2026-10-13T18:50:17.460Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110236","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-13T18:50:17.460Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110236","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJCMaGsizg","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/KDE/dolphin/blob/v26.08.2/src/dolphinmainwindow.cpp#L3195-L3225","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/kde-dolphin-24.08.0-through-26.08.2-os-command-injection-via-crafted-folder-name","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-13T18:50:17.460Z","content_hash":"64e2669aad43cb0fd861806b9edf4bb06728c4c1bf254e575cdbe8d891998dfe"}}