An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.
CVE-2021-32563
CRITICALNVD 9.89.8—
EchelonGraph scoreMEDIUM confidence
Score 9.8 from GitHub Security Advisory (severity: CRITICAL) published 2022-05-24. NVD baseline CVSS 9.8; sources differ by 0.0.
Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, nvd
9.8
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
- High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS: 3%CVSS: 9.8Exploit: NoneExposed: 0
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 9.8
- EG Score
- 9.8(medium)
- EPSS
- 86.1%
- KEV
- Not listed
Published
May 11, 2021
Last Modified
November 21, 2024
Advisory Details (8)
Auto-updated Jun 13, 2026No patch confirmed yet.
generic
oss-security - Code execution through MIME-type association of Mono interpreter and security expectations of MIME type associations
http://www.openwall.com/lists/oss-security/2023/01/05/1generic
oss-security - Re: Code execution through Thunar
http://www.openwall.com/lists/oss-security/2021/05/11/3generic
oss-security - Code execution through Thunar
https://www.openwall.com/lists/oss-security/2021/05/09/2generic
Dont execute files, passed via command line due to security risks (9165a61f) · Commits · Xfce / thunar · GitLab
https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0bgeneric
Regression: Activating Desktop Icon does not Use Default Application (3b54d9d7) · Commits · Xfce / thunar · GitLab
https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664generic
Dont execute files, passed via command line due to security risks (1b85b96e) · Commits · Xfce / thunar · GitLab
https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92dgeneric
oss-security - Re: Code execution through MIME-type association of Mono interpreter and security expectations of MIME type associations
http://www.openwall.com/lists/oss-security/2023/01/05/2Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Frequently asked(5)
What is CVE-2021-32563?
CVE-2021-32563 is a critical vulnerability published on May 11, 2021. An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.
When was CVE-2021-32563 disclosed?
CVE-2021-32563 was first published in the National Vulnerability Database on May 11, 2021, with the most recent update on November 21, 2024. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2021-32563 actively exploited?
CVE-2021-32563 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 86.1% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.
What is the CVSS score of CVE-2021-32563?
CVE-2021-32563 has a CVSS v3 base score of 9.8 (NVD).
How do I remediate CVE-2021-32563?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2021-32563, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2021-32563
Is Your Infrastructure Affected by CVE-2021-32563?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.