CVE-2026-82636
HIGH
NVD
CVSS Score
7.9
Severity
HIGH
Published
Aug 30, 2026
Vendor
unknown
Description
Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.