{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "24.08.0"
              },
              {
                "last_affected": "26.08.2"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "d9612a79bcab5e445863d6327b2774f1772534ee"
            },
            {
              "last_affected": "f19f070e7dc140213a2c6dd5d11f26122c89e1a0"
            }
          ],
          "repo": "https://github.com/kde/dolphin",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
      "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110236.json"
  },
  "details": "KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.",
  "id": "CVE-2026-110236",
  "modified": "2026-10-14T10:30:47.581134495Z",
  "published": "2026-10-13T18:50:17.460Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110236.json"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/KDE/dolphin/blob/v26.08.2/src/dolphinmainwindow.cpp#L3195-L3225"
    },
    {
      "type": "ADVISORY",
      "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJCMaGsizg"
    },
    {
      "type": "WEB",
      "url": "https://invent.kde.org/system/dolphin"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110236"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/kde-dolphin-24.08.0-through-26.08.2-os-command-injection-via-crafted-folder-name"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name"
}