CVE-2026-41525
Medium
Description
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or executables. (By default, Dolphin will then prompt the user to determine if they want to launch a script or executable; however, the intended behavior is to block the attempted action, not present a consent prompt.)
SeverityMedium
CVSS6.5
Exploit probability—
ProductDolphin
PublishedApr 28, 2026
First seenApr 28, 2026
Weakness typeCWE-669CWE-669
How to fix
Update
- KDE Dolphin25.12.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| KDE Dolphin | v < 25.12.3 | 25.12.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.