PCManFM-Qt CVE-2026-48700

Requires the ability to make a local D-Bus call to the org.freedesktop.FileManager1.ShowFolders method in a session where PCManFM-Qt is the registered FileManager1 handler (CVSS AV:L, PR:L). The specific trigger is passing a regular file's path (not a directory) as the URI argument, so that PCManFM-Qt's file-type-based delegation launches the associated program. Exploitation is limited by these factors: the attacker must already have local, authenticated access to the session; PCManFM-Qt must be installed and active as the freedesktop FileManager1 provider (LXQt desktop, versions 1.1.0-2.4.0); and success depends on the targeted file type mapping to a program that yields useful execution or namespace escape. No user interaction is needed (UI:N), which removes the usual click-to-open safeguard.

Signals conflict sharply. The CVSS 4.0 base score is 9.3 (Critical) with total confidentiality/integrity/availability impact on both the vulnerable and subsequent systems, yet the vector is AV:L (local) with PR:L, meaning an attacker already needs local, authenticated access and the ability to issue a D-Bus call in the victim's session. EPSS is essentially zero (0.01%, 2nd percentile) and CISA SSVC records Exploitation: none and Automatable: no, indicating no observed exploitation and no easy mass-automation. There is no KEV listing and no public exploit identified at time of analysis, though SSVC agrees the Technical Impact is total. Net: this is a high-severity-on-paper, low-real-world-urgency issue for most deployments - the total-impact rating is credible but gated behind local access and a somewhat contrived invocation path, and the product's small footprint further limits exposure. The vendor's own framing (spec-compliant, non-trivial to fix safely) suggests it should be treated as a hardening priority rather than an emergency patch.

A malicious or compromised local process (or a lured application integration) issues an org.freedesktop.FileManager1.ShowFolders D-Bus call passing the path of a regular file - such as an executable or a file whose type is bound to a scripting handler - as the URI. PCManFM-Qt silently delegates to the type-associated program, running it without prompting the user, giving the attacker code execution in the user's session or a means to bypass network namespace isolation. No public exploit is identified at time of analysis, and exploitation requires existing local access.