VulnSocial

CVE-2026-48700Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus method call, PCManFM-Qt delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution or circumvent network namespace restrictions. NOTE: those outcomes are potentially unwanted by most users; however, the behavior of the product does comply with the applicable specification, and a simplistic solution (ensuring that the URI does not name a regular file) may have adverse consequences for I/O.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-913

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 4 classified signals
  • Peaked 2d ago at 2 mentions (2026-05-23); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-05-23: 2Mentions · 2026-05-25: 1Mentions · 2026-05-26: 1Technical Details · 2026-05-23: 2Technical Details · 2026-05-26: 105-2305-2505-26
Signal classification1 categories
Disclosure
4100.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-05-232
Disclosure2
2026-05-251
Disclosure1
2026-05-261
Disclosure1
Full discourse4 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2026-48700: PCManFM-Qt: When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus method call, PCManFM-Qt delegates to a different program (based on the file type) without user confirmation https://www.openwall.com/lists/oss-security/2026/05/24/6

    Post summary

    PCManFM-Qt allows a file path passed via a D-Bus ShowFolders call to delegate to another program without user confirmation, marking it as a newly disclosed vulnerability. No PoC, exploit, patch, or active exploitation evidence is referenced.

    00010240
    4.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-48700 Re https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48700 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The tweet merely links to the CVE-2026-48700 page on Vulmon, offering no additional technical details or evidence of exploitation.

    0000049
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-48700 An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.ShowFolder… https://www.cve.org/CVERecord?id=CVE-2026-48700 ----- Traducción: Se descubrió un pr… http://infoflow.cloud`

    Post summary

    The message announces CVE-2026-48700, detailing an issue in PCManFM-Qt where passing a regular file path as a URI to org.freedesktop.FileManager1.ShowFolder triggers a flaw, but it does not provide proof-of-concept, exploit code, active exploitation evidence, or a patch.

    0000040
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-48700 An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.ShowFolder… https://www.cve.org/CVERecord?id=CVE-2026-48700

    Post summary

    The text announces CVE-2026-48700, a flaw in PCManFM-Qt triggered by passing a file path as a URI, with no PoC, exploit, or mitigation details provided.

    00000293
    57.5K followersView on X

Explore more

Back to dashboard