CVE-2026-62294

Deferred Deferred - Pending Action

Flameshot 14.0.0 TOCTOU Symlink Race Condition

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-62294

EUVD

EUVD-2026-44675

Affected Vendors & Products

Vendor	Product	Version / Range
flameshot	flameshot	14.0.0
flameshot	flameshot	to 14.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a TOCTOU (Time-of-Check to Time-of-Use) symlink attack in Flameshot's 'Open With' feature affecting versions before 14.0.0. The app writes screenshots to a predictable temporary path in /tmp using a filename pattern with minute resolution. An attacker can pre-create a symlink at this path, causing Flameshot to overwrite any writable file the victim user can access when saving the screenshot.

Detection Guidance

Check if Flameshot version is below 14.0.0 by running flameshot --version. Monitor /tmp directory for suspicious symlinks or unexpected file writes during Flameshot usage. Look for files with predictable names like /tmp/YYYY-MM-DD_HH-MM.png.

Impact Analysis

An attacker could overwrite critical files like ~/.bashrc, ~/.ssh/authorized_keys, or application configuration files. This could lead to system compromise, unauthorized access, or denial of service. The wide race window (up to 60 seconds) makes exploitation feasible for local attackers.

Compliance Impact

This vulnerability could lead to file integrity compromise and unauthorized data access, which may violate compliance requirements for data protection and integrity in standards like GDPR and HIPAA. Unauthorized file modifications could result in data breaches or loss of audit integrity.

Mitigation Strategies

Upgrade Flameshot to version 14.0.0 or later immediately. Avoid using the Open With feature in older versions. Regularly audit /tmp for symlinks and unexpected files. Restrict write permissions to sensitive files like ~/.bashrc or ~/.ssh/authorized_keys.

Hi! I’m here to help you understand CVE-2026-62294. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70