What is the CVSS score of CVE-2026-48700?

CVE-2026-48700 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of PCManFM-Qt are affected by CVE-2026-48700?

LXQt PCManFM-Qt file manager (versions 1.1.0-2.4.0) contains a critical local code-execution vulnerability triggered through D-Bus method mishandling without user confirmation.

How to fix or mitigate CVE-2026-48700?

Within 24 hours, inventory systems running PCManFM-Qt versions 1.1.0 through 2.4.0 to determine organizational exposure. Within 7 days, restrict D-Bus org.freedesktop.FileManager1.ShowFolders method invocations via Polkit policy rules or disable the service entirely if PCManFM-Qt is not a required component; consider replacing it with an alternative file manager in hardened configurations. Within 30 days, plan system upgrades to versions beyond 2.4.0 once patches are released, and evaluate AppArmor or SELinux confinement policies to further restrict file manager privileges on systems where it must remain.

PCManFM-Qt CVE-2026-48700

EUVD-2026-31487 CRITICAL

Improper Control of Dynamically-Managed Code Resources (CWE-913)

2026-05-22 mitre

GHSA-j7mp-frq8-hwp3

RCE Pcmanfm Qt

Critical

Disputed · 9.3 Vendor: mitre

Severity by source

Sources disagree (Medium–Critical)

Vendor (mitre) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:I/V:D/RE:M/U:Clear

vuln.today AI

8.8 HIGH

Local D-Bus invocation in an existing session gives AV:L and PR:L with no user interaction; delegation to another program escapes the file manager's control, so S:C with high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:24 vuln.today

CVE Published

May 22, 2026 - 18:43 cve.org

CRITICAL 9.3

CVE Published

May 22, 2026 - 18:43 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus method call, PCManFM-Qt delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution or circumvent network namespace restrictions. NOTE: those outcomes are potentially unwanted by most users; however, the behavior of the product does comply with the applicable specification, and a simplistic solution (ensuring that the URI does not name a regular file) may have adverse consequences for I/O.

AnalysisAI

Improper delegation of file handling in the LXQt PCManFM-Qt file manager (all releases from 1.1.0 through 2.4.0) allows a local attacker to trigger execution of arbitrary handler programs by passing a regular file's path as a URI to the org.freedesktop.FileManager1.ShowFolders D-Bus method, which opens the file with its type-associated program without user confirmation. This can yield code execution or be abused to circumvent network namespace restrictions. EPSS is negligible (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, but SSVC rates the technical impact as total.

Technical ContextAI

PCManFM-Qt is the file manager of the LXQt desktop environment (Qt port of PCManFM), identified by CPE cpe:2.3:a:lxqt:pcmanfm-qt. It implements the freedesktop.org org.freedesktop.FileManager1 D-Bus interface, whose ShowFolders method is specified to reveal a folder for a given URI. The flaw is CWE-913 (Improper Control of Dynamically-Managed Code Resources): rather than validating that the supplied URI names a directory, PCManFM-Qt dynamically selects and launches a handler program based on the target's file type. When the URI actually points to a regular file (e.g. an executable, script, or .desktop-associated type), that handler is invoked with no confirmation prompt. Notably the maintainers assert the behavior complies with the FileManager1 specification, and that naively rejecting regular-file URIs could have adverse I/O consequences - so this sits at the boundary of a spec-versus-security disagreement rather than a clear memory-safety bug.

RemediationAI

No vendor-released patched version is confirmed in the available data, so monitor the upstream releases page (https://github.com/lxqt/pcmanfm-qt/releases) and the oss-security discussion (https://www.openwall.com/lists/oss-security/2026/05/19/1 and .../05/20/2 and http://www.openwall.com/lists/oss-security/2026/05/24/6) for a fixed tag, then upgrade to it once published. As compensating controls until then: restrict or mask the org.freedesktop.FileManager1 D-Bus service so untrusted local processes cannot invoke ShowFolders (trade-off: breaks legitimate 'show in file manager' integrations from other applications); avoid running PCManFM-Qt as the registered FileManager1 handler on multi-user or sandbox-escape-sensitive hosts; and treat any workflow that feeds attacker-influenced URIs into ShowFolders as untrusted. Because the maintainers note that simply rejecting regular-file URIs may degrade I/O behavior, avoid ad-hoc local patches that blanket-block file URIs without testing.