CVE-2025-49091: Code execution from web browser using URL schemes handled by KDE's KTelnetService and Konsole
Source Reddit NetSec
Not known to be exploited · fixed in 25.04.2 : update affected systems when convenient.
Data as of 26 Oct 2026, 09:15 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 51% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 25.04.2
Exploitation evidence
Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
1. Upgrade Konsole to version 25.04.2 or later immediately to apply the official patch that addresses this vulnerability. 2. Audit systems to identify installations of KTelnetService and Konsole versions prior to 25.04.2, especially where telnet, rlogin, or ssh clients are not installed. 3. Restrict or disable the handling of telnet:, rlogin:, and ssh: URL schemes in browsers and desktop environments where possible to prevent automatic invocation. 4. Educate users about the risks of clicking on untrusted links, especially those that may trigger terminal or shell commands. 5. Implement endpoint security controls that monitor and block suspicious command executions originating from browsers or URL handlers. 6. Employ network-level protections such as web filtering and URL reputation services to block access to known malicious sites. 7. For organizations using KDE desktops, consider deploying configuration management policies that disable or tightly control KTelnetService usage. 8. 9. Conduct penetration testing or red team exercises simulating this attack vector to validate defenses and user awareness.
Description
This issue affects systems where KTelnetService and a vulnerable version of Konsole are installed but at least one of the programs telnet, rlogin or ssh is not installed. The vulnerability is in KDE's terminal emulator Konsole. As stated in the [advisory by KDE](https://kde.org/info/security/advisory-20250609-1.txt), Konsole versions < 25.04.2 are vulnerable. On vulnerable systems remote code execution from a visited website is possible if the user allows loading of certain URL schemes (telnet: