KDE Dolphin versions prior to 25.12.3 contain a vulnerability (CWE-669) where applications running under sandboxing mechanisms like Flatpak or AppArmor can bypass intended sandbox restrictions to open folders outside their confinement. This occurs because Dolphin's FileManager1 protocol implementation allows arbitrary file paths, including scripts or executables. The default behavior prompts the user before executing these files, but the secure design should prevent such execution attempts entirely. This flaw could lead to unauthorized access or execution of files outside the sandbox environment.

The vulnerability allows sandboxed applications to access folders outside their sandbox boundaries, potentially leading to unauthorized information disclosure or execution of untrusted scripts or executables. The CVSS score of 6.5 reflects a medium severity with high confidentiality and integrity impact, and low availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the KDE vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when running applications with Flatpak or AppArmor confinement that interact with Dolphin. No vendor advisory or patch links are currently provided, so monitor KDE security channels for updates.