The vulnerability arises from PCManFM-Qt's handling of URIs representing regular files in the org.freedesktop.FileManager1.ShowFolders D-Bus method. When such a URI is received, PCManFM-Qt automatically delegates handling to an external program associated with the file type without requiring user confirmation. This can be exploited to execute arbitrary code or circumvent network namespace restrictions. The issue affects all versions starting from 1.1.0. The product's behavior complies with the relevant specification, and straightforward mitigation by disallowing regular file URIs may cause adverse effects on input/output operations. No patch or official remediation level has been provided as of the publication date.

Successful exploitation can lead to arbitrary code execution or bypassing network namespace restrictions on affected systems. This could allow an attacker with local privileges to escalate their capabilities or interfere with network isolation mechanisms. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should exercise caution when handling URIs passed to the org.freedesktop.FileManager1.ShowFolders D-Bus method, especially those referencing regular files. Consider restricting access to this D-Bus method or monitoring its usage in sensitive environments until an official fix is available.