CVE-2026-41525: CWE-669 Incorrect Resource Transfer Between Spheres in KDE Dolphin
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or executables. (By default, Dolphin will then prompt the user to determine if they want to launch a script or executable; however, the intended behavior is to block the attempted action, not present a consent prompt.)
AI Analysis
Technical Summary
This vulnerability (CWE-669: Incorrect Resource Transfer Between Spheres) affects KDE Dolphin's handling of the FileManager1 protocol. Applications confined by Flatpak or AppArmor can bypass sandbox restrictions to access folders outside their intended environment. The protocol implementation permits any file path type, including potentially dangerous scripts or executables. By default, Dolphin prompts the user before launching these files, but this is contrary to the intended security model, which should prevent such access without user interaction. The issue is present in Dolphin versions prior to 25.12.3.
Potential Impact
The vulnerability can lead to unauthorized access to files and directories outside of an application's sandbox, potentially exposing sensitive data or allowing execution of untrusted code with user interaction. The CVSS score of 6.5 reflects a medium severity with high confidentiality and integrity impact, low availability impact, and requiring local access with high attack complexity and user interaction.
Mitigation Recommendations
No official patch or remediation level has been confirmed yet. Users should upgrade to KDE Dolphin version 25.12.3 or later once available, as this version is indicated to fix the issue. Until then, users should exercise caution when running applications in Flatpak or with AppArmor confinement that interact with Dolphin. Monitor KDE's official advisories for updates and apply patches promptly when released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-41525: CWE-669 Incorrect Resource Transfer Between Spheres in KDE Dolphin
Description
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or executables. (By default, Dolphin will then prompt the user to determine if they want to launch a script or executable; however, the intended behavior is to block the attempted action, not present a consent prompt.)
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-669: Incorrect Resource Transfer Between Spheres) affects KDE Dolphin's handling of the FileManager1 protocol. Applications confined by Flatpak or AppArmor can bypass sandbox restrictions to access folders outside their intended environment. The protocol implementation permits any file path type, including potentially dangerous scripts or executables. By default, Dolphin prompts the user before launching these files, but this is contrary to the intended security model, which should prevent such access without user interaction. The issue is present in Dolphin versions prior to 25.12.3.
Potential Impact
The vulnerability can lead to unauthorized access to files and directories outside of an application's sandbox, potentially exposing sensitive data or allowing execution of untrusted code with user interaction. The CVSS score of 6.5 reflects a medium severity with high confidentiality and integrity impact, low availability impact, and requiring local access with high attack complexity and user interaction.
Mitigation Recommendations
No official patch or remediation level has been confirmed yet. Users should upgrade to KDE Dolphin version 25.12.3 or later once available, as this version is indicated to fix the issue. Until then, users should exercise caution when running applications in Flatpak or with AppArmor confinement that interact with Dolphin. Monitor KDE's official advisories for updates and apply patches promptly when released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-04-20T00:00:00.000Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f0602fcbff5d8610cfd2bf
Added to database: 4/28/2026, 7:22:23 AM
Last enriched: 4/28/2026, 7:37:18 AM
Last updated: 4/29/2026, 5:27:48 AM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.