EUVD-2026-25566
GHSA-7824-f4f9-2x77
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.
AnalysisAI
KDE Arianna's bookserver before version 26.04.1 allows local attackers to read arbitrary files over socket connections by guessing URLs without authentication, exploiting missing input validation on the bookserver endpoint. The vulnerability requires local access and does not affect confidentiality of other system components; no public exploit code or active exploitation has been identified.
Technical ContextAI
KDE Arianna's bookserver component exposes a socket-based interface for book content retrieval. The vulnerability stems from CWE-306 (Missing Authentication Check), where the socket listener fails to validate or authenticate requested URLs before serving file content. An attacker with local system access can directly connect to the bookserver socket and craft arbitrary file paths without needing valid credentials or authorization tokens, bypassing the authentication mechanism entirely. The socket-based architecture creates a local attack surface distinct from network-facing vulnerabilities.
RemediationAI
Upgrade KDE Arianna to version 26.04.1 or later; this is the primary vendor-released patch addressing the authentication bypass. Users unable to upgrade immediately should restrict local access to systems running Arianna where possible-disable multi-user login on shared machines or isolate Arianna to dedicated user accounts with minimal system privileges. Consider running Arianna in a confined environment (e.g., namespace/container) if it must coexist with untrusted local users. The socket-based bookserver can be disabled entirely if Arianna's offline book features are not required, eliminating the attack surface, though this removes core functionality. Patch availability is confirmed via KDE's official advisory (kde.org/info/security/advisory-20260424-1.txt) and upstream commits on the KDE GitLab instance.
khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) a
Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3, when the context menu is
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write t
ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to as
KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and le
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with min
aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hi
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, whic
rendering/render_replaced.cpp in Konqueror in KDE before 4.9.3 allows remote attackers to cause a denial of service (NUL
KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE. Rated medium s
A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will tri
okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" i
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: LowShare
External POC / Exploit Code
Leaving vuln.today