CVE-2026-62294

Name of the Vulnerable Software and Affected Versions Flameshot versions prior to 14.0.0

Description The Open With feature writes screenshots to a predictable temporary path and follows symlinks. This creates a time-of-check to time-of-use (TOCTOU) race condition—a scenario where a system checks a condition (such as a file's existence) and then uses the result, but the condition changes between the check and the use. A local unprivileged attacker can exploit this by pre-planting a symlink, causing the software to write PNG data through it and overwrite any file the victim user has permissions to write.

Recommendations Update to version 14.0.0.