CVE-2014-2528: kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remo...

Security readout for executives and security teams

KDirStat 2.7.3 could mishandle a directory name containing a single quote when deleting directories. If a user deleted an attacker-named directory with the vulnerable cleanup code, command execution could result. The sources do not provide CVSS, broad product mapping, or evidence of active exploitation. Likely exposure is limited to systems running vulnerable KDirStat 2.7.3 or related distro packages. Risk is higher where users inspect and delete attacker-controlled directories from archives, shared folders, removable media, or network locations. Treat as a targeted workstation hygiene issue, not an emergency from the provided evidence. Prioritize patching any installed KDirStat packages, especially on analyst or developer machines handling untrusted files. Mitigation focus: Upgrade KDirStat packages to vendor-fixed builds where available.; Apply distro security updates referencing CVE-2014-2528.; Avoid deleting untrusted directories with vulnerable KDirStat versions..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.