Hi,

The following vulnerability was published for vifm.

CVE-2026-110237[0]:
| Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the
| shared temporary directory without checking ownership, allowing
| local users to execute commands as another user. Attackers can pre-
| create a world-writable vifm-ipc-vifm FIFO and write IPC packets
| with -c and ! shell commands that execute with the victim's
| privileges.

This doesn't seem to have been reported upstream yet.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-110237
https://www.cve.org/CVERecord?id=CVE-2026-110237

Please adjust the affected versions in the BTS as needed.