CVE-2018-10361: n/a vulnerability

CVE-2018-10361: An issue was discovered in KTextEditor 5.34.0 through 5.45.0.

An issue was discovered in KTextEditor 5.34.0 through 5.45.0. Insecure handling of temporary files in the KTextEditor's kauth_ktexteditor_helper service (as utilized in the Kate text editor) can allow other unprivileged users on the local system to gain root privileges. The attack occurs when one user (who has an unprivileged account but is also able to authenticate as root) writes a text file using Kate into a directory owned by a another unprivileged user. The latter unprivileged user conducts a symlink attack to achieve privilege escalation.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 5, 2024, 07:39 UTC (UTC+00:00)

Security readout for executives and security teams

CVE-2018-10361 is a local privilege-escalation issue in KTextEditor used by Kate. Under specific multi-user conditions, an unprivileged local user could abuse temporary-file handling and gain root privileges. This is not described as remote or actively exploited in the provided sources. Exposure is most likely on Linux desktop or shared systems running vulnerable KTextEditor/Kate versions, especially KDE environments with multiple local users. Single-user desktops have lower practical exposure, but vulnerable packages should still be remediated. Treat this as a focused local-privilege risk, not an internet-wide emergency. Prioritize patching shared KDE workstations, lab machines, and administrative desktops where local users could interact with privileged file operations. Mitigation focus: Check distribution advisories for patched KTextEditor or Kate packages.; Upgrade KTextEditor beyond the affected 5.34.0 through 5.45.0 range.; Limit local shell access on shared systems until patched..

Prepared: Jun 7, 2026, 13:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Privilege behavior lookup

The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup

cve · low confidence lookup

CVE-2018-10361 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Apr 25, 2018, 05:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://bugzilla.suse.com/show_bug.cgi?id=1033055CVE reference · x_refsource_MISC

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.