CVE-2022-32278: Debian Linux

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Xfce Exo: before 4.16.4 (fixed in 4.16.4); from 4.17.0, before 4.17.2 (fixed in 4.17.2)

Published 2022-06-13. Last modified 2026-06-17.