CVE-2018-6791

MEDIUM

KDE Plasma Workspace < 5.12.0 - OS Command Injection via vfat Thumbdrive Volume Label

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-6791. PoCs published by rarar0.

AI-analyzed exploit summary This repository contains a writeup discussing the KDE vFAT vulnerability (CVE-2018-6791), focusing on its limited scope and the 11-character limit on vFAT labels. It explores potential bypasses but does not include functional exploit code.

Description

An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.

Exploits (1)

nomisec WRITEUP 1 stars
by rarar0 · poc
https://github.com/rarar0/KDE_Vuln

This repository contains a writeup discussing the KDE vFAT vulnerability (CVE-2018-6791), focusing on its limited scope and the 11-character limit on vFAT labels. It explores potential bypasses but does not include functional exploit code.

Classification
Writeup 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: KDE (specific version not specified)
No auth needed
Prerequisites: Physical access to the target machine · Target system running a vulnerable version of KDE
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4116
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugs.kde.org/show_bug.cgi?id=389815

Scores

CVSS v3 6.8
EPSS 0.0026
EPSS Percentile 49.5%
Attack Vector PHYSICAL
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
debian/debian_linux 9.0
kde/plasma-workspace < 5.12.0
Published Feb 07, 2018
Tracked Since Feb 18, 2026