CVE-2026-123784

high

Description

Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.

References

https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values

https://github.com/fluxbox/fluxbox/pull/89

https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f

https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.cc#L192-L264

https://github.com/fluxbox/fluxbox

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118302

Details

Source: Mitre, NVD

Published: 2026-11-06

Updated: 2026-11-06

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.5

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00708