CVE-2021-32563

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.

• CWE-913

• http://www.openwall.com/lists/oss-security/2021/05/11/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/01/05/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/01/05/2Mailing List, Third Party Advisory
• https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92dPatch
• https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664Patch
• https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0bPatch
• https://gitlab.xfce.org/xfce/thunar/-/tagsRelease Notes
• https://www.openwall.com/lists/oss-security/2021/05/09/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/11/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/01/05/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/01/05/2Mailing List, Third Party Advisory
• https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92dPatch
• https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664Patch
• https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0bPatch
• https://gitlab.xfce.org/xfce/thunar/-/tagsRelease Notes
• https://www.openwall.com/lists/oss-security/2021/05/09/2Mailing List, Third Party Advisory

Published

May 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32557It was discovered that the process_report() function in data…7.1
• CVE-2021-32558An issue was discovered in Sangoma Asterisk 13.x before 13.3…7.5
• CVE-2021-32559An integer overflow exists in pywin32 prior to version b301 …6.5
• CVE-2021-3256KuaiFanCMS V5.x contains an arbitrary file read vulnerabilit…6.5
• CVE-2021-32560The Logging subsystem in OctoPrint before 1.6.0 has incorrec…6.5
• CVE-2021-32561OctoPrint before 1.6.0 allows XSS because API error messages…6.1
• CVE-2021-32565Invalid values in the Content-Length header sent to Apache T…7.5
• CVE-2021-32566Improper Input Validation vulnerability in HTTP/2 of Apache …7.5
• CVE-2021-32567Improper Input Validation vulnerability in HTTP/2 of Apache …7.5
• CVE-2021-32568mrdoc is vulnerable to Deserialization of Untrusted Data7.8
• CVE-2021-32569In OSS-RC systems of the release 18B and older customer docu…6.1
• CVE-2021-32570In Ericsson Network Manager (ENM) releases before 21.2, user…4.9