CVE-2025-49091
HIGHKDE Konsole < 25.04.2 - Remote Code Execution via URL Scheme Handler Fallback
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-49091. PoCs published by thefreestyleresearcher.
AI-analyzed exploit summary This exploit leverages a cache poisoning vulnerability in Gajim's avatar handling (CVE-2025-49091) to achieve remote code execution (RCE) on KDE Plasma systems running Konsole < 25.04.2. The PoC uses XMPP to deliver an obfuscated payload via avatar metadata, triggering command execution when processed by the target's system.
Description
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
Exploits (1)
This exploit leverages a cache poisoning vulnerability in Gajim's avatar handling (CVE-2025-49091) to achieve remote code execution (RCE) on KDE Plasma systems running Konsole < 25.04.2. The PoC uses XMPP to deliver an obfuscated payload via avatar metadata, triggering command execution when processed by the target's system.
References (7)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L