Back Linuxsecurity

Fedora 45 Tokodon Update Fixes Crafted Folder Command Execution

Linuxsecurity •LinuxSecurity Advisories • October 29, 2026

Two serious PHP flaws could let an attacker run code without logging in. See which setups and PHP versions are affected ×

Tokodon is a Mastodon client for Plasma and Plasma Mobile.

KDE Plasma 6.8.1 + Gear 28.08.2 (And related rebuilds) CVE-2026-110236 Arbitrary command execution via crafted folder name

* Fri Oct 23 2026 Jan Grulich - 26.08.2-2 - Rebuild (qt6) * Thu Oct 8 2026 Steve Cossette - 26.08.2-1 - 26.08.2

[ 1 ] Bug #2559827 - FE Tracker: Plasma 6.8[.1] + Gear 26.08.2

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-21f4914bca' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Fedora 45 Applications Patched for Command Execution Vulnerability A vulnerability (CVE-2026-110236) affecting various Fedora 45 applications has been disclosed, allowing arbitrary command execution via crafted folder names. The flaw impacts applications such as KDE Portal, Spacebar, Spectacle, and others, primarily on systems using KDE Plasma 6.8.1 and Gear 28.08.2. The vulnerability was published on October 13, 2026, with a CVSS score of 7.1, indicating a high severity. Affected versions include multiple KDE applications, and users are urged to apply updates immediately to mitigate risks. The updates can be installed using the 'dnf' package manager. Exploitation of this vulnerability could allow attackers to execute commands without user authentication, posing a significant threat to system integrity. 17 sources 70

Extracted Entities

Fedora 45 Tokodon Update Fixes Crafted Folder Command Execution

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)