Description

Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-11-06T15:17:21.297Z",
  "pubdate": "2026-11-06T15:17:21.297Z",
  "executiveSummary": "Fluxbox versions up to 1.3.7 are susceptible to an OS command injection vulnerability located within the RootTheme::reconfigTheme() function. This security flaw stems from the insecure handling of style configuration files, specifically regarding background property definitions.\nAn attacker can craft a malicious style file containing shell metacharacters within parameters such as background pixmap paths, random directories, or gradient texture strings. When the application loads these styles, the unsanitized input is concatenated into a system command executed via '$SHELL -c' invoking 'fbsetbg'.\nThis vulnerability allows for arbitrary command execution with the privileges of the user running the Fluxbox window manager. Successful exploitation requires the application to process a user-supplied or attacker-controlled style file. The impact includes full compromise of the user session, unauthorized data access, and potential persistence mechanisms within the local environment. Given the nature of window manager configurations, this vulnerability poses a significant risk to desktop environments where users may inadvertently load untrusted or maliciously crafted themes.",
  "technicalDetails": "The vulnerability resides in the RootTheme::reconfigTheme() function within the Fluxbox window manager, specifically in how the application manages theme configuration parsing. The core issue is an improper neutralization of special characters when constructing shell commands used to initialize the desktop background.\nWhen a user selects or loads a theme, Fluxbox processes various configuration parameters to determine the desktop background appearance. These parameters include file paths for pixmaps, directory names, and textural gradient definitions. The application utilizes the 'fbsetbg' utility to apply these settings. However, the implementation of RootTheme::reconfigTheme() fails to implement adequate input validation or sanitization before passing these configuration strings to the system shell.\nThe attack flow proceeds as follows: 1) An attacker provides or induces the target to use a crafted Fluxbox style file. 2) Inside this file, the attacker injects shell metacharacters (such as backticks, semicolons, or pipe symbols) into fields that are subsequently used as arguments for 'fbsetbg'. 3) Upon theme activation, the application concatenates these tainted strings directly into a shell command string. 4) The application executes this string using '$SHELL -c', which interprets the injected shell metacharacters. 5) The shell interprets the attacker-supplied commands, leading to arbitrary code execution.\nThis vulnerability is highly effective because it leverages the legitimate functional path of the window manager to achieve execution. Because 'fbsetbg' is invoked via the shell, the command injection is trivial for an attacker familiar with shell syntax. The execution context is strictly bound to the privilege level of the user initiating the Fluxbox session. No authentication bypass is required to trigger the flaw, as the vulnerability is inherent to the application's processing logic. The risk is predominantly local, necessitating a mechanism to deploy the malicious style file to the victim's filesystem or triggering the loading of a remote style through a compromised configuration source. Once triggered, the attacker achieves arbitrary command execution within the user's process space, enabling subsequent actions such as unauthorized file access, credential harvesting, or further exploitation of the local desktop environment."
}