CVE-2026-48700: PCManFM-Qt: unsafe delegation of file URIs via D-Bus ShowFolders
CVE-2026-48700 affects LXQt PCManFM-Qt. When a regular file path is passed as a URI to the org.freedesktop.FileManager1.ShowFolders D-Bus method, the application hands the file to another program chosen by file type, without user confirmation. MITRE scores it 9.3 under CVSS 4.0, but the record lists no fixed version, the CVE is not in CISA KEV, and the record notes the behavior complies with the applicable specification.
Overview
CVE-2026-48700 is classified as CWE-913 (Improper Control of Dynamically-Managed Code Resources) in LXQt PCManFM-Qt. According to the record, a regular file path supplied as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus call is passed to a different program selected by file type, without user confirmation. MITRE is the CNA, the record was published on 2026-05-22, and its status is Deferred.
Impact
- The record states the issue could be used to achieve code execution.
- The record states it could be used to circumvent network namespace restrictions.
- MITRE rates the vulnerability 9.3 under CVSS 4.0, with a vector showing local attack vector, low privileges required, no user interaction, and high confidentiality, integrity and availability impact.
- The SSVC data in the record lists technical impact as total, exploitation as none and automatable as no.
Affected products and versions
- Product: LXQt PCManFM-Qt.
- The narrative describes all versions starting from 1.1.0. The structured affected range is 1.1.0 through 2.4.0 inclusive.
- The record lists no fixed versions.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record. The record gives an EPSS probability of 0.0017 with a percentile of 0.0588. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Check the upstream releases page listed in the references and update to a version the maintainers confirm as fixed. The record does not identify one.
- Until a fix is confirmed, review whether PCManFM-Qt is installed and whether its D-Bus file manager interface can be reached by untrusted local processes.
- Review default handlers for file types in the desktop environment, since the record says delegation depends on file type.
- The record warns that a simplistic fix may affect I/O, so test any configuration change before wide deployment.
Detection guidance
- Monitor for applications launched by the file manager process in response to file-opening requests that were not initiated by the user.
- Review endpoint telemetry for unexpected child processes spawned by PCManFM-Qt.
- Treat these signals as indicative only. The record does not describe specific indicators of compromise.
Limitations of the available information
- The record provides no fixed version, patch commit or vendor advisory text.
- The narrative says all versions from 1.1.0 are affected, while the structured range is bounded at 2.4.0. The record does not explain the upper bound.
- The record notes the behavior complies with the applicable specification, so whether this is a defect is disputed.
- The title field was empty in the record. The title used here is derived from the description.
Frequently asked questions
What does CVE-2026-48700 affect?
According to the record, it affects LXQt PCManFM-Qt. The structured affected range is 1.1.0 through 2.4.0, while the narrative says all versions starting from 1.1.0.
Is this vulnerability being actively exploited?
It is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted. The record gives an EPSS probability of 0.0017.
Is there a fixed version?
The record does not list any fixed version. Check the upstream releases page and apply only a version the maintainers confirm as fixed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.