CVE Alert: CVE-2026-123784 – fluxbox

Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.

**Risk verdict:** This is a high-impact local execution risk; exploitation urgency cannot be confirmed because KEV, SSVC, PoC and EPSS status are not provided.

**Why this matters:** Successful exploitation could give an attacker the logged-in desktop user’s ability to read or alter data, install persistence, or disrupt the workstation. The most realistic route is a malicious or tampered theme, rather than unsolicited remote access.

**Most likely attack path:** An attacker with a way to place or influence a style file gets the victim’s Fluxbox session to load it; the vulnerable background value is then passed to a shell. Local access is required, but no additional privilege is indicated; user interaction is required, though loading a style may happen as part of ordinary session use. Scope is unchanged, so impact is expected within the user’s security context, with no indicated direct cross-boundary impact.

**Who is most exposed:** Linux desktops and workstations running Fluxbox are the main concern, especially where users import themes or administrators distribute shared styles.

Review style files for shell metacharacters in background, pixmap, directory, or gradient values.

Alert on unexpected `fbsetbg` or shell child processes launched by Fluxbox.

Investigate unusual commands and file changes in desktop-session audit logs.

Mitigation and prioritisation

Upgrade to a release containing the upstream fix; verify the installed package is patched.

Until upgraded, block untrusted theme imports and restrict who can modify shared styles.

Test approved themes, then deploy the fix through normal workstation change controls.

Obtain KEV, SSVC, PoC and EPSS data before setting exploitation-based priority; current urgency remains uncertain.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.