KDE Dolphin EUVD-2026-26003

The vulnerability requires that the Dolphin process runs outside a sandbox (the typical case) while a malicious or compromised application runs inside a Flatpak or AppArmor-confined environment. Exploitation specifically depends on the confined application being able to invoke D-Bus calls to org.freedesktop.FileManager1 interface, which is typically accessible to sandboxed applications by default in Flatpak and AppArmor setups. The attack does not require elevated privileges (PR:N), but does require user interaction (UI:R) in the form of the user accepting a consent prompt when opening executable files, or the user simply viewing the file contents if it is a regular file. The vulnerability does NOT affect Dolphin installations running in restricted environments where D-Bus access is further constrained, nor does it affect sandboxed Dolphin instances themselves (the risk is to the host filesystem when Dolphin is used as a service). Non-default configurations such as disabling the FileManager1 D-Bus service or running Dolphin fully sandboxed would prevent exploitation.

This vulnerability presents moderate real-world risk with important contextual limitations. The CVSS score of 6.5 (Medium) reflects the local attack vector (AV:L), high complexity (AC:H), and requirement for user interaction (UI:R), which appropriately constrains the severity. However, the exploitation conditions are narrow: the vulnerability only affects applications explicitly sandboxed with Flatpak or AppArmor, and requires a malicious application running in the sandbox to make a crafted D-Bus call. The absence of network attack vector and the requirement for sandbox compromise first significantly reduces real-world exposure. EPSS data is not provided, limiting probabilistic assessment. The vulnerability does not appear in CISA KEV (no confirmed active exploitation reported), and no public POC is referenced in the available intelligence. The high-complexity rating (AC:H) suggests exploitation requires non-trivial sandbox manipulation or crafted application behavior. Organizations running trusted applications in sandboxed environments face lower risk; those allowing untrusted third-party Flatpak applications from repositories should prioritize patching. The information disclosure and code execution potential (I:H, C:H) justify timely remediation despite the attack complexity, but this is not an urgent critical vulnerability demanding immediate action across all environments.

An attacker distributes a trojanized application via Flatseal or as a custom Flatpak. When the user launches the malicious application (which runs sandboxed), the application makes a D-Bus call to Dolphin's FileManager1.OpenFile or OpenFolder method with an absolute path to a sensitive file outside the sandbox (e.g., /home/user/.ssh/id_rsa or /etc/passwd). Dolphin, running unsandboxed, opens the path and displays it, allowing the attacker's application to read or execute the file depending on user interaction.