{"id":"CVE-2026-62294","summary":"Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot \"Open With\"","details":"Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.","aliases":["GHSA-fqqf-4rj8-c392"],"modified":"2026-08-12T16:09:56.470689Z","published":"2026-07-15T14:20:43.746Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-362","CWE-377"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62294.json"},"references":[{"type":"WEB","url":"https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62294.json"},{"type":"ADVISORY","url":"https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62294"},{"type":"FIX","url":"https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96"},{"type":"FIX","url":"https://github.com/flameshot-org/flameshot/pull/4716"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/flameshot-org/flameshot","events":[{"introduced":"0"},{"fixed":"936716b8d8b7052be461c3d5e2f88492b6eb3b96"},{"fixed":"e408812d77ff1835957f85796c4cf737466bd69d"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"14.0.0"}]}}],"versions":["v14.0.rc3","v14.0.rc2","v14.0.rc1","v13.3.0","v13.2.0","v13.1.0","v13.0.1","v13.0.0","v13.0.rc2","v13.0.rc1","v12.1.0","v12.0.0","v12.0.rc1","v11.0.0","v11.0.rc1","v0.10.1","v0.10.0","v0.9.0.rc2","v0.9.0.rc1","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.8.0.rc1","v0.6.0","v0.5.1","v0.5.0","v0.4.2","v0.4.1","v0.4.0","v0.3.0","v0.2.1","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62294.json","vanir_signatures_modified":"2026-08-12T16:09:56Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96","target":{"function":"AppLauncherWidget::launch","file":"src/tools/launcher/applauncherwidget.cpp"},"deprecated":false,"digest":{"function_hash":"329605074164803606157478097203046202912","length":1245},"id":"CVE-2026-62294-11984417","signature_type":"Function"},{"source":"https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96","target":{"file":"src/tools/launcher/applauncherwidget.cpp"},"deprecated":false,"digest":{"line_hashes":["112328897413780299589051903442372619767","68312888393137108945287911995787412454","125789848484622751684559607443017598059","45270114591322014304855380586813254263","333050165625785274008178503583450428136","57965323388132286618923840173178916765","212507817426916838795140120928568540493","221153500671977028086308229775405416817","296700099617002055436625743550212334851","319029609650180418026696598999322644547","142505899428123923218833978452398540185","84167170933618895731167851766548769523","82002758968671481573518401094832009172","162830424504602650898367012479917721359","59948615802729520809847169597852206968","295927896137084652750516728093260901631","303714367432867019540770391856751509714","184635111450697052691866185717047864199","333892074519149830837220590792072765903","223771662359002679904161042955226566549","70746881077850945852317678738782064827","16763534947215502051644909432233890125","95064690247972388892275783468132850512","79951211087729589257300495931624752033","78599253593692037380460988149472486713","325897859798765641466643934976385512905"],"threshold":0.9},"id":"CVE-2026-62294-3dc038b4","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/tools/launcher/terminallauncher.cpp"},"deprecated":false,"digest":{"line_hashes":["239880740311440777646140086999921917087","166748749844800868288136878817935402847","335042716210720189580360428873298104016","138458018282389218549426390316483252261","237061794334360977183884423232929859845"],"threshold":0.9},"id":"CVE-2026-62294-580ce047","signature_type":"Line","signature_version":"v1","source":"https://github.com/flameshot-org/flameshot/commit/e408812d77ff1835957f85796c4cf737466bd69d"},{"deprecated":false,"digest":{"function_hash":"141687574828168291303624200656276278529","length":169},"id":"CVE-2026-62294-69e62da8","signature_type":"Function","signature_version":"v1","source":"https://github.com/flameshot-org/flameshot/commit/e408812d77ff1835957f85796c4cf737466bd69d","target":{"function":"TerminalLauncher::launchDetached","file":"src/tools/launcher/terminallauncher.cpp"}},{"signature_version":"v1","source":"https://github.com/flameshot-org/flameshot/commit/e408812d77ff1835957f85796c4cf737466bd69d","target":{"file":"src/tools/launcher/terminallauncher.h"},"deprecated":false,"digest":{"line_hashes":["292061124165107953561886575158341480445","324369514787206041714754615817928276433","19900738757637991076763279369416279291","299770886445714952793544920098671380913"],"threshold":0.9},"id":"CVE-2026-62294-b22ba75e","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"318441185560744759581544457208319395242","length":1597},"id":"CVE-2026-62294-b3586564","signature_type":"Function","signature_version":"v1","source":"https://github.com/flameshot-org/flameshot/commit/e408812d77ff1835957f85796c4cf737466bd69d","target":{"function":"AppLauncherWidget::launch","file":"src/tools/launcher/applauncherwidget.cpp"}},{"deprecated":false,"digest":{"line_hashes":["157365449200678816088176423877963322400","67760930791020623248663200229056122334","283197678779167348091158657850874450664","194837751072990870707321307029957495626","210830843419861771296887850701768288919","144814856166697757405064268493242400319","166624055759527790558124517414735674571","111132648497300147947774772913999545389"],"threshold":0.9},"id":"CVE-2026-62294-e1776a9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96","target":{"file":"src/tools/launcher/applauncherwidget.h"}},{"id":"CVE-2026-62294-f7442b87","signature_type":"Line","signature_version":"v1","source":"https://github.com/flameshot-org/flameshot/commit/e408812d77ff1835957f85796c4cf737466bd69d","target":{"file":"src/tools/launcher/applauncherwidget.cpp"},"deprecated":false,"digest":{"line_hashes":["162523894218150715828963676742557135385","56166000339538356261307210041892975272","292024468253314906531267348675576925836","305387915548590007980216974354183956235","327809959521394222926276933237578803616","156545717694006985702670784265488398924","184289064455011435406742533307988712432","244842236901693760962208356702464258516","276405747329256525318482529417230186300","41313207777637609427820703010903391966","64608136380965156479339409293049993766","66119876153629915192214840696692116357"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}