PT-2026-60196 · Flameshot Org · Flameshot

Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-62294

Mitre

CVSS v4.0

5.1

Média

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

CWE-377

Identificadores relacionados

CVE-2026-62294

Produtos afetados

Flameshot

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-62294 · Nota de Segurança
• https://github.com/flameshot-org/flameshot/pull/4716 · Nota
• https://github.com/flameshot-org/flameshot/commit/936716b8d8b7052be461c3d5e2f88492b6eb3b96 · Nota
• https://github.com/flameshot-org/flameshot/security/advisories/GHSA-fqqf-4rj8-c392 · Nota
• https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0 · Nota