All current versions of PCManFM‑Qt from 1.1.0 onward admit a routine file path as a URI to the D‑Bus org.freedesktop.FileManager1.ShowFolders method. The file manager forwards the request to an external program based on the file type without prompting the user. This allows an attacker to trigger execution of arbitrary code or to circumvent restrictions imposed by the network namespace. The vulnerability is a manifestation of CWE‑913, where privileged functionality is delegated indirectly.

The affected product is LXQt's PCManFM‑Qt, versions starting at 1.1.0, present on all distributions that ship the component. No narrower version range is specified, so every build after this baseline is vulnerable.

With a CVSS score of 9.3 the flaw is considered critical. No EPSS data is available, so the precise exploitation likelihood is unknown, but the nature of the flaw suggests that local attackers who can invoke D‑Bus calls could abuse it. The flaw is not listed in CISA's KEV table. The attack vector is local and requires the ability to send a D‑Bus message to the file manager; an attacker could also deliver a malicious file through the file manager interface to trigger the delegation.