KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2add2065d0 advisory.

    - CVE-2026-110236 Arbitrary command execution via crafted folder name

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-21f4914bca advisory.

    KDE Plasma 6.8.1 + Gear 28.08.2 (And related rebuilds)

    ----

    - CVE-2026-110236 Arbitrary command execution via crafted folder name





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-85f07f4f1b advisory.

    - CVE-2026-110236 Arbitrary command execution via crafted folder name

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-77dc014196 advisory.

    Automatic update for dolphin-26.08.2-2.fc46.

    ##### **Changelog**

    ```
    * Fri Oct 16 2026 Than Ngo <than@redhat.com> - 26.08.2-2
    - Fix rhbz#2553643 - CVE-2026-110236 dolphin: dolphin: Arbitrary command execution via crafted folder name

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers     to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers     can embed a double quote and shell metacharacters in a directory name to escape quoting in     slotDoubleClickViewBackground, executing commands when victims double-click the view background.
    (CVE-2026-110236)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376132	Fedora 43 : dolphin (2026-2add2065d0)	Nessus	Fedora Local Security Checks	Local	high
373920	Fedora 45 : accessibility-inspector / akonadi-calendar / akonadi-calendar-tools / etc (2026-21f4914bca)	Nessus	Fedora Local Security Checks	Local	high
369945	Fedora 44 : dolphin (2026-85f07f4f1b)	Nessus	Fedora Local Security Checks	Local	high
367833	Fedora 46 : dolphin (2026-77dc014196)	Nessus	Fedora Local Security Checks	Local	high
365939	Linux Distros Unpatched Vulnerability : CVE-2026-110236	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-110236

high

Tenable Plugins

high

high

high

high

high