PT-2026-35677 · Kde · Dolphin

Aaron Rainbolt · Published 2026-04-28 · Updated 2026-05-19 · CVE-2026-41525

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions KDE Dolphin versions prior to 25.12.3

Description Applications running within a Flatpak or with AppArmor confinement can open folders outside of the application sandbox without additional scrutiny. This occurs because the implementation of the FileManager1 protocol allows the provided path to be any file type, including scripts or executables. While the software prompts the user before launching such files, the intended security behavior is to block the action entirely. There have been reports of elevated activities targeting this issue.

Recommendations Update to version 25.12.3 or later.

Fix

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2026-41525

Affected Products

Dolphin

References · 14

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41525 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41525 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41525 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41525 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-41525 · Security Note
• https://github.com/KDE/dolphin/releases/tag/v25.12.3 · Note
• https://twitter.com/vuldb/status/2049314624244535722 · Twitter Post
• https://t.me/cveNotify/163977 · Telegram Post
• https://t.me/cveNotify/161220 · Telegram Post
• https://invent.kde.org/system/dolphin · Note
• https://kde.org/info/security/advisory-20260427-2.txt · Note
• http://openwall.com/lists/oss-security/2026/05/19/1 · Note
• https://t.me/CVEtracker/52055 · Telegram Post