CVE-2026-123784 | BDVDB-2026-401277 Detail
fluxboxfluxbox
Description#
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.
Weaknesses#
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References#
- https://github.com/fluxbox/fluxbox/pull/89
- https://github.com/fluxbox/fluxbox
- https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f
- https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.cc#L192-L264
- https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.