EUVD-2026-44675Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring victim to invoke Open With (UI:R); race condition elevates AC:H; no confidentiality impact, only file integrity and availability affected.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.
AnalysisAI
Flameshot's 'Open With' feature prior to version 14.0.0 contains a TOCTOU (time-of-check to time-of-use) symlink-following race condition that allows a local unprivileged attacker on the same machine to overwrite arbitrary files writable by the victim user. By pre-planting a symlink at the predictable temporary file path before Flameshot writes the screenshot PNG, an attacker can redirect the write operation to any file within the victim's permissions - including configuration files, SSH keys, or application data. No public exploit identified at time of analysis, though the attack is straightforward given the deterministic path; the vendor-confirmed fix is available in v14.0.0.
Technical ContextAI
Flameshot (cpe:2.3:a:flameshot-org:flameshot:*:*:*:*:*:*:*:*) is a Qt-based cross-platform screenshot utility. The vulnerable code resides in src/tools/launcher/applauncherwidget.cpp within the AppLauncherWidget class. Prior to v14.0.0, the 'Open With' workflow computed a deterministic temporary filename using FileNameHandler().properScreenshotPath(QDir::tempPath(), "png"), then wrote the screenshot PNG to that path - with no atomic file creation, no randomization, and no symlink-following protection. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) is the root cause: the window between the path being computed and the file being written is exploitable by a local attacker who races to place a symlink at that location. The fix (PR #4716, commit 936716b) replaces the predictable path with Qt's QTemporaryFile API, which atomically creates a file using an _XXXXXX randomized suffix pattern - closing the race window by eliminating the predictable path entirely.
RemediationAI
Upgrade to Flameshot 14.0.0 or later, available at https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0. The fix (PR #4716, commit 936716b8d8b7052be461c3d5e2f88492b6eb3b96) replaces the predictable properScreenshotPath() temp file computation with Qt's QTemporaryFile, which atomically creates a uniquely-named file and eliminates the symlink pre-planting window. If immediate upgrade is not possible, the primary compensating control is to avoid or disable use of the 'Open With' feature in Flameshot - since the vulnerability is only reachable through that specific code path and not through standard screenshot capture. In multi-user Linux environments, ensuring /tmp is mounted with the sticky bit (standard on most distributions) prevents users from deleting or replacing each other's temp files, but does not fully close the race if the attacker can predict the filename before it is created. No side effects are associated with the upstream patch beyond the functional behavior change to temp file naming.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today