CVE-2026-123784
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme()…
- Risk score
- 47/100
- CVSS
- 7.8 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated une…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.8 high
References
- https://github.com/fluxbox/fluxbox
- https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.cc#L192-L264
- https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f
- https://github.com/fluxbox/fluxbox/pull/89
- https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values
Original description
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.
Last activity 6 Nov 2026. Patch Forecast updates every hour.