CVE-2026-62294

Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96
https://github.com/flameshot-org/flameshot/pull/4716
https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0
https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Flameshot es un software de captura de pantalla potente pero sencillo de usar. Antes de la versión 14.0.0, la función Abrir con escribía las capturas de pantalla en una ruta temporal predecible y seguía los enlaces simbólicos, creando una condición de carrera de tiempo de verificación a tiempo de uso que permitía a un atacante local sin privilegios en la misma máquina preestablecer un enlace simbólico y hacer que Flameshot escribiera datos PNG a través de él, sobrescribiendo cualquier archivo que el usuario víctima pudiera escribir. Este problema está solucionado en la versión 14.0.0.

Information

Published : 2026-07-15 15:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-62294

Mitre link : CVE-2026-62294

CVE.ORG link : CVE-2026-62294

JSON object : View

Products Affected

No product.

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-377

Insecure Temporary File

{"id": "CVE-2026-62294", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62294", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T17:59:53.344366Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "flameshot-org", "product": "flameshot", "versions": [{"status": "affected", "version": "< 14.0.0"}]}]}], "published": "2026-07-15T15:16:49.010", "references": [{"url": "https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96", "source": "security-advisories@github.com"}, {"url": "https://github.com/flameshot-org/flameshot/pull/4716", "source": "security-advisories@github.com"}, {"url": "https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-377"}]}], "descriptions": [{"lang": "en", "value": "Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0."}, {"lang": "es", "value": "Flameshot es un software de captura de pantalla potente pero sencillo de usar. Antes de la versi\u00f3n 14.0.0, la funci\u00f3n Abrir con escrib\u00eda las capturas de pantalla en una ruta temporal predecible y segu\u00eda los enlaces simb\u00f3licos, creando una condici\u00f3n de carrera de tiempo de verificaci\u00f3n a tiempo de uso que permit\u00eda a un atacante local sin privilegios en la misma m\u00e1quina preestablecer un enlace simb\u00f3lico y hacer que Flameshot escribiera datos PNG a trav\u00e9s de \u00e9l, sobrescribiendo cualquier archivo que el usuario v\u00edctima pudiera escribir. Este problema est\u00e1 solucionado en la versi\u00f3n 14.0.0."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "security-advisories@github.com"}