Is CVE-2026-41525 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41525 being exploited in the wild.

How severe is CVE-2026-41525?

Medium severity, with a CVSS score of 6.5, published 28 April 2026.

Is there a fix for CVE-2026-41525?

A patch was published on 2026-05-05: Version 25.12.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41525 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-41525?

Check whether you run Kde Dolphin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41525: KDE Dolphin sandbox escape via FileManager1 protocol

CVE-2026-41525 · Severity: medium · CVSS 6.5 · Published 2026-04-28

KDE Dolphin, a popular file manager for Linux systems, contains a vulnerability that allows sandboxed applications (like those in Flatpak or AppArmor) to bypass security restrictions. By exploiting how Dolphin handles folder-opening requests, a malicious application can trick the system into running unauthorized scripts or executables outside of its restricted environment. This could lead to a full system compromise or unauthorized access to sensitive user data.

Vendors: Kde.

Quick answers

Is CVE-2026-41525 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41525 being exploited in the wild.
How severe is CVE-2026-41525?: Medium severity, with a CVSS score of 6.5, published 28 April 2026.
Which products and versions are affected?: Kde Dolphin before 25.12.3.
Is there a fix for CVE-2026-41525?: A patch was published on 2026-05-05: Version 25.12.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41525 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-41525?: Check whether you run Kde Dolphin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Dolphin's implementation of the org.freedesktop.FileManager1.ShowFolders D-Bus interface allows for a sandbox escape. While the protocol is intended to only handle folder paths, Dolphin incorrectly processed file paths, including executables and scripts, as valid arguments. If an attacker provides a path to a malicious executable, Dolphin may attempt to 'activate' or run the file. While Dolphin typically prompts the user before execution, this behavior bypasses the intended security boundary of Flatpak or AppArmor confinement, potentially leading to arbitrary code execution if the user accepts the prompt or has configured Dolphin to run scripts automatically. The issue is fixed in version 25.12.3.

Affected products

KDE Dolphin before 25.12.3

Timeline

2026-04-27: advisory: KDE Project Security Advisory released
2026-04-28: disclosed: CVE-2026-41525 published
2026-05-05: patched: Version 25.12.3 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.