CVE-2026-62294

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62294", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-13T18:37:08.488Z", "datePublished": "2026-07-15T14:20:43.746Z", "dateUpdated": "2026-07-15T18:00:42.038Z"}, "containers": {"cna": {"title": "Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot \"Open With\"", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-377", "lang": "en", "description": "CWE-377: Insecure Temporary File", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392"}, {"name": "https://github.com/flameshot-org/flameshot/pull/4716", "tags": ["x_refsource_MISC"], "url": "https://github.com/flameshot-org/flameshot/pull/4716"}, {"name": "https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96", "tags": ["x_refsource_MISC"], "url": "https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96"}, {"name": "https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0"}], "affected": [{"vendor": "flameshot-org", "product": "flameshot", "versions": [{"version": "< 14.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T14:20:43.746Z"}, "descriptions": [{"lang": "en", "value": "Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0."}], "source": {"advisory": "GHSA-fqqf-4rj8-c392", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T17:59:53.344366Z", "id": "CVE-2026-62294", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T18:00:42.038Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62294", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T17:59:53.344366Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T18:00:35.476Z"}}], "cna": {"title": "Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot \"Open With\"", "source": {"advisory": "GHSA-fqqf-4rj8-c392", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "flameshot-org", "product": "flameshot", "versions": [{"status": "affected", "version": "< 14.0.0"}]}], "references": [{"url": "https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392", "name": "https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/flameshot-org/flameshot/pull/4716", "name": "https://github.com/flameshot-org/flameshot/pull/4716", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96", "name": "https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0", "name": "https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-377", "description": "CWE-377: Insecure Temporary File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T14:20:43.746Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62294", "state": "PUBLISHED", "dateUpdated": "2026-07-15T18:00:42.038Z", "dateReserved": "2026-07-13T18:37:08.488Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-15T14:20:43.746Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "flameshot", "vendor": "flameshot-org", "versions": [{"status": "affected", "version": "< 14.0.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0."}, {"lang": "es", "value": "Flameshot es un software de captura de pantalla potente pero sencillo de usar. Antes de la versi\u00f3n 14.0.0, la funci\u00f3n Abrir con escrib\u00eda las capturas de pantalla en una ruta temporal predecible y segu\u00eda los enlaces simb\u00f3licos, creando una condici\u00f3n de carrera de tiempo de verificaci\u00f3n a tiempo de uso que permit\u00eda a un atacante local sin privilegios en la misma m\u00e1quina preestablecer un enlace simb\u00f3lico y hacer que Flameshot escribiera datos PNG a trav\u00e9s de \u00e9l, sobrescribiendo cualquier archivo que el usuario v\u00edctima pudiera escribir. Este problema est\u00e1 solucionado en la versi\u00f3n 14.0.0."}], "id": "CVE-2026-62294", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62294", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T17:59:53.344366Z", "version": "2.0.3"}}]}, "published": "2026-07-15T15:16:49.010", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96"}, {"source": "security-advisories@github.com", "url": "https://github.com/flameshot-org/flameshot/pull/4716"}, {"source": "security-advisories@github.com", "url": "https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-377"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,14.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "flameshot", "source": "cna", "vendor": "flameshot-org"}, "product": "flameshot", "vendor": "flameshot-org"}], "created": "2026-07-17T05:30:04.202829+00:00", "updated": "2026-07-31T03:45:04.676532+00:00", "vendors": ["flameshot-org", "flameshot-org$PRODUCT$flameshot"]}