EUVD-2026-99018
GHSA-h249-j3v7-74fw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local user account on host
-
DeliveryPredict victim's Elio process ID
-
ExploitPre-create symlink at capture path
-
ExecutionVictim previews media/font/archive
-
ImpactOverwrite victim-owned file
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Secure temp file creation
|
| Exploitation Conditions | Requires an unprivileged local account on the same host as the victim (multi-user/shared system). The attacker must know or predict the victim's running Elio process ID and pre-create a symbolic link at the predictable external-preview capture path before the victim acts. Exploitation only fires when the victim actively previews a media, font, or archive file that invokes Elio's external capture command. Limiting factors: no remote vector (AV:L), required victim interaction (UI:A), dependence on PID prediction / symlink race timing (AT:P), and an existing local foothold (PR:L); impact is limited to overwriting files writable by the victim, with no read/confidentiality exposure. |
| Impact | This is a medium-severity, low-real-world-priority issue. The CVSS 4.0 base score of 4.1 is driven by a high integrity impact (VI:H - file truncation/overwrite) but constrained by multiple attacker barriers: AV:L requires local access to the same host, PR:L requires an existing local account, UI:A requires the victim to actively trigger a preview, and AT:P reflects the additional requirement of predicting the victim's Elio process ID / winning a symlink race. There is no confidentiality (VC:N) or availability (VA:N) impact. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of exploitation - status is no public exploit identified at time of analysis. A notable conflict: the input tag labels this 'Information Disclosure,' but the CVSS vector (VC:N, VI:H) and CWE-377 describe a local file-overwrite/integrity flaw, not disclosure - the tag appears mislabeled and should not drive prioritization. Overall this is a genuine but narrow local-attack vulnerability affecting multi-user systems, not a widespread or urgent threat. |
| Exploit ScenarioDerived | On a shared multi-user host, a local unprivileged attacker determines the victim's running Elio process ID and pre-creates a symbolic link at the predictable temporary capture path Elio uses for external previews. When the victim then previews a media, font, or archive file, Elio writes the capture output through the attacker's symlink, truncating and overwriting an arbitrary victim-owned file. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Elio through 1.13.0 writes the output of its external preview capture commands to predictable temporary paths, so an unprivileged local attacker who can guess or predict a victim's Elio process ID can pre-plant a symbolic link at that path and cause the victim's own preview of a media, font, or archive file to truncate and overwrite a file the victim owns. Exploitation requires an existing local foothold on a shared/multi-user host plus victim interaction (the victim must actively preview an affected file type), making this a medium-severity, low-real-world-priority integrity issue with no confidentiality impact; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
RemediationAI
No vendor-released patch was identified at time of analysis - version 1.13.0 is the latest release referenced and remains the last affected version, so users should track the Elio project (https://github.com/elio-fm/elio/releases) and the VulnCheck advisory (https://www.vulncheck.com/advisories/elio-through-1.13.0-insecure-temporary-file-creation-in-external-preview-command-capture) for an upstream fix rather than assuming one exists. Until a fixed release is available, apply targeted compensating controls: where possible, run Elio only on single-user workstations or sessions where no untrusted local account shares the host, which removes the attacker prerequisite entirely (trade-off: not viable on genuinely multi-user/VDI hosts); mount /proc with hidepid=1 or hidepid=2 (or otherwise restrict PID visibility, e.g. via per-user PID namespaces) so an attacker cannot enumerate or predict the victim's Elio process ID and target the correct capture path (trade-off: changes system-wide process visibility and can break monitoring/debugging tooling); restrict write access to the shared temp/capture directory so unprivileged users cannot create entries there ahead of the victim (trade-off: may require per-user TMPDIR/TMP/TEMP configuration and can perturb other applications relying on the shared location); and reduce exposure by avoiding or disabling previews of untrusted media, font, and archive files - e.g. not opening externally supplied archives/fonts in Elio and, if configurable in the user's build, avoiding the external capture tools referenced in src/preview/external_commands.rs and src/preview/archives/external_tools.rs (trade-off: loss of preview functionality). Because exploitation also requires victim interaction (UI:R), user awareness training and avoiding preview of untrusted files on shared systems provides additional defense. Authentication requirements for the attack are confirmed as an unprivileged local account (CVSS PR:L); there is no remote vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-377 (insecure temporary file), a classic symlink-following flaw in code that creates or opens a temporary file at a name derived from a predictable value. Elio's preview subsystem shells out to external capture tools for non-text content: src/preview/external_commands.rs (lines 14-47 and 92-95) and src/preview/archives/external_tools.rs (lines 30-45) construct capture paths for media, font, and archive previews. Because the path is predictable and the file is opened/truncated without O_EXCL/no-follow semantics or a securely randomized name, the preview write follows whatever the path currently resolves to - including a symlink an attacker has already created. The attacker only needs write access to the directory holding the capture path (typically a shared /tmp-style location) plus knowledge of the victim's PID to target the right path, meaning the vulnerability turns a benign preview action into an arbitrary-file-overwrite primitive limited to files the victim can write. The independent assessment scores this CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N - local, high attack complexity (symlink race/PID prediction), authenticated local user, user interaction required, unchanged scope, high integrity impact, and no confidentiality or availability impact.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Local attacker with an account (PR:L) must win a PID-prediction/symlink race (AC:H) and rely on victim previewing a file (UI:R); only integrity is affected (I:H), no read access.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB