KDE Dolphin vulnerabilities

Latest KDE Dolphin CVEs

Newest publication first

1. CVE-2026-110236 KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name

   Published 2026-10-13

   High·CVSS 7.1 EPSS 1.0%

   KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name...

2. CVE-2026-41525 KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of t...

   Published 2026-04-28

   Medium·CVSS 6.5 EPSS 0.13%

   KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.