CVE-2026-62294
Last modified
CVE-2026-62294 is a medium-severity vulnerability rated 5.1/10 on the CVSS scale. Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write.
Description
Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| flameshot-org | flameshot | < 14.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-62294?
How severe is CVE-2026-62294?
How do I fix CVE-2026-62294?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-6227The BackWPup plugin for WordPress is vulnerable to Local Fil…7.2
- CVE-2026-6228The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
- CVE-2026-62287Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2026-6229The Royal Elementor Addons plugin for WordPress is vulnerabl…7.2
- CVE-2026-62290cert-manager adds certificates and certificate issuers as re…7.3
- CVE-2026-62293HAPI FHIR is a complete implementation of the HL7 FHIR stand…5
- CVE-2026-62295HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
- CVE-2026-62296HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
- CVE-2026-62299CoreDNS is a DNS server written in Go. Prior to 1.14.5, the …5.3
- CVE-2026-6230The Tainacan plugin for WordPress is vulnerable to time-base…7.5
- CVE-2026-62309CoreDNS is a DNS server written in Go. Prior to 1.14.4, a si…7.5
- CVE-2026-6231The bson_validate function may return early on specific inpu…7.5
Are you affected by CVE-2026-62294?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST