CVE-2026-110236 is a High severity (CVSS 7.0) OS command injection in KDE Dolphin 24.08.0 through 26.08.2. A crafted folder name can break out of quoting and run commands when a user double-clicks the view background. We could not confirm a fixed version, so check KDE for an update.
What's affected
The record says KDE Dolphin 24.08.0 through 26.08.2 is affected. VulnCheck gives the same range. Neither page names a fixed release, and the third reference is a source file at the 26.08.2 tag, so we do not state a patched version. Check the KDE release announcements and your distribution's security updates.
The weakness is CWE-78, OS command injection. Per the record, the code that handles a double click on the background of a folder view substitutes the folder path into a command through a path placeholder. A double quote plus shell metacharacters in a directory name can escape the quoting around that value.
The record gives CVSS 7.0, with a local attack vector, high attack complexity and a requirement for user interaction. VulnCheck lists 7.1. Both are High. The practical risk is a person opening a malicious folder, for example one that came from an archive, a download or a shared drive.
How to check if you're exposed
Check the installed Dolphin version.
dolphin --version
If the output is between 24.08.0 and 26.08.2, you are in range. On most distributions, KDE Gear applications are packaged together, so also check your package manager for pending updates.
The record ties the flaw to the double click on the view background. Check your Dolphin settings for any custom command tied to that action. The pages we read do not say whether a default install is exposed, so update either way. Also look at the folder names in directories you open from untrusted sources. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Update Dolphin through your distribution as soon as a build that fixes this CVE is available, and confirm the version against KDE's announcement.
- Remove any custom command tied to a double click on the view background, if you do not use it.
- Do not open folders that come from untrusted archives or downloads in a file manager. Extract them first and look at the names in a terminal.
- On shared workstations, review who can change Dolphin settings and which commands are configured.
- Subscribe to your distribution's security mailing list so the fixed package reaches you quickly.
Why it matters
Command injection through file names is a long running class of bug. A file name is just a string, and almost any character is allowed on Linux. When a program pastes a file name into a command line, the shell reads every quote and symbol in it as syntax.
The safer pattern is to pass arguments as a list to the process API, which avoids the shell entirely, or to escape every value with a function designed for that shell. The risk here is limited by the local vector and the need for a user action, but a desktop file manager is something people use with downloaded content every day. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
Which Dolphin versions are affected?
24.08.0 through 26.08.2, according to the record and VulnCheck.
Is a fixed release named?
We could not confirm one from the pages we read. Check KDE's announcements and your distribution's updates.
Sources
Last reviewed: 18 October 2026.
