CVE-2026-48700: PCManFM-Qt RCE Vulnerability

CVE-2026-48700 Overview

CVE-2026-48700 affects all versions of PCManFM-Qt starting from 1.1.0, the default file manager for the LXQt desktop environment. When a regular file path is passed as a URI to the org.freedesktop.FileManager1.ShowFolders D-Bus method, PCManFM-Qt delegates handling to another program based on the file's MIME type without prompting the user. Attackers can leverage this behavior to achieve code execution or bypass network namespace restrictions on a target system. The issue is tracked under CWE-913: Improper Control of Dynamically-Managed Code Resources.

Critical Impact
A local attacker capable of triggering a D-Bus ShowFolders call with a crafted file URI can cause arbitrary program execution outside expected sandbox or namespace boundaries.

Affected Products

PCManFM-Qt 1.1.0 and all later versions
LXQt desktop environments shipping PCManFM-Qt as the default file manager
Linux distributions packaging vulnerable pcmanfm-qt builds

Discovery Timeline

2026-05-22 - CVE CVE-2026-48700 published to NVD
2026-05-24 - Last updated in NVD database

Technical Details for CVE-2026-48700

Vulnerability Analysis

The vulnerability stems from how PCManFM-Qt handles the freedesktop FileManager1 D-Bus interface. The ShowFolders method is specified to display folder locations, and callers normally pass directory URIs. PCManFM-Qt, however, accepts URIs pointing to regular files and dispatches them through MIME-based application delegation. The dispatched handler runs in the caller's expected context without user confirmation, turning a folder-display request into an arbitrary program launch.

Because delegation is automatic, an adversary can construct a URI that resolves to an executable script, a .desktop file, or another file type associated with a sensitive handler. The vendor notes that the behavior complies with the freedesktop specification, but the practical outcome is undesirable for most users.

Root Cause

The root cause is dynamic code resource control under [CWE-913]. PCManFM-Qt trusts the URI argument without enforcing that the target is a directory before delegating. A naïve fix that rejects regular-file URIs would break legitimate I/O workflows, so a balanced mitigation requires changes to the delegation logic itself.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker invokes org.freedesktop.FileManager1.ShowFolders over the session bus with a URI naming a regular file. PCManFM-Qt resolves the file type and invokes the associated program. When combined with files placed inside or outside a network namespace, the call can escape namespace-based isolation by delegating to a process that runs in the parent context.

No public proof-of-concept code is currently available. Refer to the OpenWall OSS-Security thread and the follow-up discussion for the technical reasoning behind the report.

Detection Methods for CVE-2026-48700

Indicators of Compromise

Unexpected child processes spawned by pcmanfm-qt that are not standard file-browsing helpers.
D-Bus traffic on the session bus invoking org.freedesktop.FileManager1.ShowFolders with URIs ending in regular-file extensions instead of directory paths.
Processes launched by PCManFM-Qt that cross network namespace boundaries unexpectedly.

Detection Strategies

Audit session D-Bus message logs with dbus-monitor --session for ShowFolders calls referencing non-directory URIs.
Monitor process ancestry on Linux endpoints for pcmanfm-qt parenting interpreters such as bash, python3, or xdg-open shortly after a D-Bus event.
Correlate file-access telemetry to identify execution of .desktop files or scripts located in user-writable paths immediately after a file-manager activity.

Monitoring Recommendations

Enable Linux auditd rules on execve events whose parent binary is pcmanfm-qt and ship them to a centralized log platform.
Track namespace transitions using nsenter and unshare telemetry to detect delegation escaping configured sandboxes.
Alert on new or modified .desktop files in writable directories such as ~/.local/share/applications/.

How to Mitigate CVE-2026-48700

Immediate Actions Required

Upgrade PCManFM-Qt to a patched release as soon as the LXQt project publishes a fixed version through the pcmanfm-qt release page.
Restrict which local accounts can reach the session bus on shared or multi-tenant Linux hosts.
Review applications and services that programmatically invoke org.freedesktop.FileManager1.ShowFolders and validate that they only pass directory URIs.

Patch Information

The LXQt project tracks fixes through GitHub releases. Consult the pcmanfm-qt releases and the OSS-Security update thread for the version that resolves CVE-2026-48700. Distribution maintainers should rebuild and ship the patched package across supported channels.

Workarounds

Configure callers to canonicalize URIs and verify the target is a directory before invoking ShowFolders.
Replace PCManFM-Qt with an alternate file manager on hosts where patches are not yet available and the FileManager1 interface is exposed to untrusted local input.
Remove or restrict MIME associations for high-risk handlers so delegation cannot reach interpreters or .desktop launchers.

bash

# Configuration example: audit ShowFolders D-Bus calls and pcmanfm-qt child execs
dbus-monitor --session "interface='org.freedesktop.FileManager1',member='ShowFolders'"

# Linux auditd rule to capture exec events spawned by pcmanfm-qt
sudo auditctl -a always,exit -F arch=b64 -S execve -F ppid=$(pgrep -x pcmanfm-qt) -k pcmanfm_qt_exec