← Vulnerability feed

Vulnerability record · CVE-2021-32563 · published 11 May 2021

CVE-2021-32563: Xfce thunar improper control of dynamically-managed code vulnerability

Xfce · Thunar

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.

9.8 CVSS 3.1 Critical EPSS 3.0% · top 12.9% CWE-913 · Improper control of dynamically-managed code
9.8CVSS 3.1 base score, v2 7.5
3.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References
17 Jun 2026Last modified by NVD

Description

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.openwall.com/lists/oss-security/2021/05/11/3 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/01/05/1 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/01/05/2 Mailing ListThird Party Advisory
https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d Patch
https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664 Patch
https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b Patch
https://gitlab.xfce.org/xfce/thunar/-/tags Release Notes
https://www.openwall.com/lists/oss-security/2021/05/09/2 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/11/3 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/01/05/1 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/01/05/2 Mailing ListThird Party Advisory
https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d Patch
https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664 Patch
https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b Patch
https://gitlab.xfce.org/xfce/thunar/-/tags Release Notes
https://www.openwall.com/lists/oss-security/2021/05/09/2 Mailing ListThird Party Advisory

Track CVE-2021-32563 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2011-1588Xfce thunar vulnerabilityThunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error.EPSS 1.1%4.7CVE-2018-18398Xfce thunar out-of-bounds read vulnerabilityXfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bound…EPSS 0.32%8.8CVE-2025-68613n8n workflow expression evaluation RCE for authenticated usersn8n versions from 0.211.0 before 1.120.4, 1.121.1, and 1.122.0 evaluate user-supplied workflow expressions in an execution context that is not suffic…KEVEPSS 99%analysed

Source: NIST National Vulnerability Database (record CVE-2021-32563), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.