CVE-2026-62294

Name	CVE-2026-62294
Description	Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
flameshot (PTS)	bullseye	0.9.0+ds1-2+deb11u2	vulnerable
	bookworm	12.1.0-2	vulnerable
	trixie	12.1.0+ds-2	vulnerable
	forky	13.3.0+git20251204-2	vulnerable
	sid	14.0.0-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
flameshot	source	(unstable)	14.0.0-1

Notes

https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392
https://github.com/flameshot-org/flameshot/pull/4716
Fixed by: https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96 (v14.0.0)