An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 7, 2018 |
| Debian | — | Upgrade plasma-workspace | Feb 18, 2018 | Feb 6, 2018 |
| Gentoo Linux | — | Upgrade kde-plasma/plasma-workspace. | Mar 19, 2018 | Feb 6, 2018 |
| Suse | — | Upgrade plasma5-workspace-develUpgrade drkonqi5Upgrade plasma5-workspaceUpgrade plasma5-workspace-langUpgrade plasma5-workspace-libs | Feb 9, 2018 | Feb 6, 2018 |
| Ubuntu | — | Upgrade plasma-workspace | Nov 19, 2024 | Feb 7, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub