An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files. Reference: https://codereview.qt-project.org/c/qt/qtbase/+/280730
Created qt tracking bugs for this issue: Affects: fedora-all [bug 1993139] Created qt3 tracking bugs for this issue: Affects: fedora-all [bug 1993137] Created qt5 tracking bugs for this issue: Affects: fedora-all [bug 1993138]
Upstream commit: https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=commitdiff;h=bf131e8d2181b3404f5293546ed390999f760404 It seems the problematic code was introduced via the following commit in version 5.6.0: https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=commitdiff;h=3146dadb42cb36aff83a62e831b8b4f4dc1562a7
Currently qt5 from versions 5.6.0 up to 5.12.7 and 5.14.0 allows plugins to be loaded from CWD. This may lead to arbitrary code execution, as QT plugin manager may eventually load a compromised plugin maliciously placed into CWD by an attacker instead a legit one.