Executive brief
PCManFM-Qt is a file manager used in Linux desktop environments. A vulnerability exists where the application incorrectly handles requests to show folders by opening files instead. This allows a malicious program, even one restricted in a security sandbox, to trick the file manager into launching other applications or executing code on the host system, potentially leading to a full system compromise or data theft.
Technical details
A vulnerability exists in PCManFM-Qt's implementation of the 'org.freedesktop.FileManager1.ShowFolders' D-Bus method. While the specification intended this method for displaying directory contents, PCManFM-Qt fails to verify if the provided URI is a directory and instead passes it to a routine that performs a MIME handler lookup and launch. An attacker with local access (e.g., from within a Flatpak or Snap sandbox) can call this method with a path to a malicious file (such as an EXE handled by Wine). This results in the execution of the file outside the sandbox's restrictions. The vendor has disputed the necessity of a fix, citing performance concerns regarding I/O blocking during file-type verification.
Affected products
- LXQt PCManFM-Qt 1.1.0 to 2.4.0
Timeline
- 2026-02-01: disclosed: Reported privately to LXQt developers.
- 2026-05-22: advisory: CVE published.