CVE-2026-123784highCWE-78

CVE-2026-123784: high-severity vulnerability in fluxbox

Fluxbox through 1.3.7 OS Command Injection via Style Background Values

Published

Follow this CVE+ Monitor fluxbox+ Monitor fluxbox

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
fluxbox · fluxbox
Related CVEs — fluxbox

In the same product, most dangerous first.

CVE-2026-123785MEDIUMFluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style GeometryEPSS —