An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. (CVE-2026-48700)

CVE-2026-48700 affects PCManFM-Qt versions starting from 1.1.0. When a regular file path is passed as a URI to the org.freedesktop.FileManager1.ShowFolders D-Bus method, PCManFM-Qt automatically delegates handling to an external program determined by the file type without requiring user confirmation. This can be exploited to achieve code execution or circumvent network namespace restrictions. The product's behavior complies with the relevant specification, and straightforward mitigations such as blocking regular file URIs may cause undesirable I/O consequences.

The vulnerability allows an attacker with local privileges and access to the D-Bus interface to cause PCManFM-Qt to launch external programs without user confirmation, potentially leading to arbitrary code execution or bypassing network namespace restrictions. This could compromise system security and user isolation. However, no known exploits are reported in the wild, and the behavior is consistent with the product specification.

No official patch or fix is currently documented. Users should monitor vendor advisories for updates. Due to the product behavior complying with specifications and the complexity of simple mitigations, cautious evaluation is recommended before applying any workaround. Restricting access to the D-Bus interface or limiting untrusted inputs to the ShowFolders method may reduce risk.