KDE Dolphin from version 24.08.0 through 26.08.2 suffers from an OS command injection flaw that allows an attacker to cause arbitrary shell commands to be executed when the victim double‑clicks the view background over a folder whose name contains malicious payloads. The vulnerability arises because a crafted folder name is substituted into the {path} placeholder used by the slotDoubleClickViewBackground function without proper sanitization, enabling the injection of double quotes and shell metacharacters. On execution, the injected command runs with the privileges of the Dolphin process, providing the attacker the ability to run any commands on the victim’s system and potentially take full control of the machine.

The product affected is KDE Dolphin, in releases 24.08.0 through 26.08.2 inclusive. Any installation of these versions that uses the default view background double‑click action is vulnerable; newer releases beyond 26.08.2 are not listed as affected by the current information.

The CVSS score of 7.1 classifies the flaw as moderate‑to‑high severity, and it is not listed in CISA's KEV catalog. The EPSS score of 1% indicates a low yet non‑zero likelihood of exploitation. Based on the description, it is inferred that the primary attack vector is local: an attacker must be able to place a maliciously named folder on the victim’s filesystem and then persuade or trick the victim into double‑clicking the view background. Remote exploitation is possible only if the victim’s desktop environment can be triggered to open a malicious folder via phishing or other social engineering techniques.