CVE-2025-66002 Local users can perform arbitrary unmounts via smb4k mount helper due to lack of input validation
Local attackers can execute arbitrary unmount commands via argument injection in the smb4k mount helper, potentially escalating privileges or disrupting services.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66002?
CVE-2025-66002 is a medium-severity command injection vulnerability in https://github.com/KDE/ smb4k, published on 8 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper
Weakness: CWE-88
Which versions are affected by CVE-2025-66002?
How do I fix CVE-2025-66002?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-66002 being exploited?
There is no known exploitation of CVE-2025-66002 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-66002, GHSA-g8f7-f2vp-fv6x, UBUNTU-CVE-2025-66002.