KDE Dolphin EUVD-2026-99020

Requires a directory whose name contains a double quote plus shell metacharacters to physically exist on the victim's filesystem - delivered out-of-band via a malicious archive, shared/network folder, USB drive, or cloned repository - and the victim must open that directory in a vulnerable Dolphin build (24.08.0-26.08.2) and double-click the empty view background, which invokes slotDoubleClickViewBackground and substitutes the attacker-controlled folder name into the {path} placeholder of a shell command. Limiting factors: no remote/network vector (AV:L), mandatory active user interaction (UI:A - the background double-click), the crafted folder must already be present (AT:P), execution is confined to the victim user's privileges (no scope change, SC/SI/SA:N), and only the listed version range is affected.

This is a genuine but interaction-gated local code-execution issue rather than a mass-exploitable remote flaw. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:A) confirms a LOCAL attack vector requiring active victim interaction (a double-click) and a present attack condition (AT:P), which is why the base score lands at 7.1 (High) rather than Critical despite the full VC:H/VI:H/VA:H impact of OS command injection (CWE-78). No EPSS score and no CISA KEV entry were provided, and there is no explicit POC flag in the input; however, a public technical write-up (hackmd.io) and a VulnCheck advisory exist alongside a direct pointer to the vulnerable source line (dolphinmainwindow.cpp L3195-L3225), so the mechanics are publicly documented and reproduction is low-effort. The signals are internally consistent: a network vector is NOT claimed anywhere, so there is no CVSS-vs-description conflict to flag. Real priority is moderate - exploitation is trivial once a victim opens an attacker-controlled folder, but the local vector plus mandatory user interaction limits it to social-engineering / shared-media delivery rather than drive-by or wormable spread. Absence of EPSS/KEV data means widespread-exploitation likelihood cannot be quantified from the provided inputs.

An attacker delivers a directory (via a shared network folder, USB drive, downloaded/extracted archive, or cloned repository) containing a subfolder whose name embeds a double quote and shell metacharacters. When the victim opens that directory in KDE Dolphin and double-clicks the empty view background, the crafted name is substituted into the {path} placeholder and the escaped shell command executes with the victim's privileges. Public technical write-ups and a VulnCheck advisory document the mechanism, so reproduction is straightforward.