{"id":"CVE-2026-110234","summary":"Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture","details":"Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.","modified":"2026-10-15T02:47:27.681547826Z","published":"2026-10-13T18:50:16.051Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110234.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-377"]},"references":[{"type":"WEB","url":"https://crates.io"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110234.json"},{"type":"ADVISORY","url":"https://github.com/elio-fm/elio/releases/tag/v1.13.0"},{"type":"ADVISORY","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/r1d_wQojfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110234"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/elio-through-1.13.0-insecure-temporary-file-creation-in-external-preview-command-capture"},{"type":"PACKAGE","url":"https://github.com/elio-fm/elio"},{"type":"ARTICLE","url":"https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/archives/external_tools.rs#L30-L45"},{"type":"ARTICLE","url":"https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L14-L47"},{"type":"ARTICLE","url":"https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L92-L95"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elio-fm/elio","events":[{"introduced":"0"},{"fixed":"e7daae44ce748310de441499576bdc31b936d54c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.13.0"},{"fixed":"1.13.0"}],"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"]}}],"versions":["v1.12.0","v1.11.2","v1.11.1","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.1","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110234.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}