Log in Start free

Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-62294Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"

Medium 5.1

In plain English

A medium-severity race condition in flameshot from flameshot-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.1%top 96.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12flameshotno fix listedDEBIAN-CVE-2026-62294
Debian:13flameshotno fix listedDEBIAN-CVE-2026-62294
Debian:14flameshot14.0.0-1DEBIAN-CVE-2026-62294
Ubuntu:22.04:LTSflameshotno fix listedUBUNTU-CVE-2026-62294
Ubuntu:24.04:LTSflameshotno fix listedUBUNTU-CVE-2026-62294
Ubuntu:26.04:LTSflameshotno fix listedUBUNTU-CVE-2026-62294

Affected products (as reported)

VendorProductVersions
flameshot-org flameshot < 14.0.0

Weakness: CWE-362, CWE-377 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References