CVE-2026-123784
Fluxbox through 1.3.7 OS Command Injection via Style Background Values
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.
| CWE | CWE-78 |
| Vendor | fluxbox |
| Product | fluxbox |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for fluxbox fluxbox
Be the first to know when new high vulnerabilities affecting fluxbox fluxbox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
fluxbox / fluxbox
0 ≤ 1.3.7
References
github.com: https://github.com/fluxbox/fluxbox/pull/89 github.com: https://github.com/fluxbox/fluxbox github.com: https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f github.com: https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.cc#L192-L264 vulncheck.com: https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values
Credits
Igor Marcel Mathias Gumz