Description
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | plasma-workspace | 4:5.12.0-2 | — |
| Debian 13 | plasma-workspace | 4:5.12.0-2 | — |
| Debian 12 | plasma-workspace | 4:5.12.0-2 | — |
| Debian 9 | plasma-workspace | 4:5.8.6-2.1+deb9u1 | DSA-4116-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | plasma-workspace | 4:5.5.5.2-0ubuntu1.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 12 SP3 | plasma5-workspace | 5.8.7-8.1 | openSUSE-SU-2018:0398-1, openSUSE-SU-2018:0397-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
rarar0/KDE_Vuln ★ 1 · Feb 12, 2018
CVE-2018-6791 Troubleshooting
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DSA-4116-1 plasma-workspace - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2018:0397-1 Security update for plasma5-workspace SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2018:0398-1 Security update for plasma5-workspace SUSE / openSUSE Security Updates · Feb 4, 2026