CVE-2026-123784 Fluxbox through 1.3.7 OS Command Injection via Style Background Values
HighCVSS 8.5
EPSS 0.71%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/fluxbox(Debian:12) | All versions | No fix listed |
| debian/fluxbox(Debian:14) | All versions | No fix listed |
| debian/fluxbox(Debian:13) | All versions | No fix listed |
| ubuntu/fluxbox(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/fluxbox(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/fluxbox(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/fluxbox(Ubuntu:26.10) | All versions | No fix listed |
| fluxbox/fluxbox | <= 1.3.7 | No fix listed |
| debian/fluxbox(Debian:12) | = 1.3.5-2.1 | No fix listed |
| debian/fluxbox(Debian:12) | = 1.3.6-1~exp1 | No fix listed |
| debian/fluxbox(Debian:12) | = 1.3.7-1 | No fix listed |
| debian/fluxbox(Debian:12) | = 1.3.7-1~exp1 | No fix listed |
| debian/fluxbox(Debian:13) | = 1.3.7-1 | No fix listed |
| debian/fluxbox(Debian:14) | = 1.3.7-1 | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2568284 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com product
- RootTheme::reconfigTheme technical-description
- Fix commit 270bfbc patch
- Pull Request #89 issue-tracking patch
- VulnCheck Advisory: Fluxbox through 1.3.7 OS Command Injection via Style Background Values third-party-advisory
- Debian Security Tracker CVE-2026-123784 vendor-advisory
- bugs.debian.org issue-tracking
- Ubuntu CVE tracker vendor-advisory