Executive brief
Flameshot, a popular open-source screenshot tool, was found to use predictable file names when saving temporary images for its 'Open With' feature. A malicious user on the same computer could exploit this by creating a symbolic link that redirects the screenshot data to overwrite important system or user files. This could lead to data loss or the corruption of configuration files, potentially affecting the stability of the user's account.
Technical details
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in Flameshot's 'Open With' functionality. The application generates temporary filenames using a predictable pattern based on the current date and minute (e.g., /tmp/YYYY-MM-DD_HH-MM.png). Because the existence check in 'src/utils/filenamehandler.cpp' follows symbolic links and the subsequent file save operation lacks the O_EXCL flag, a local unprivileged attacker can pre-plant a symlink at the predicted path. When the victim uses the 'Open With' feature, Flameshot writes PNG data through the symlink, overwriting any file the victim has write permissions for, such as configuration files or SSH keys. This issue is resolved in version 14.0.0.
Affected products
- flameshot-org Flameshot < 14.0.0
Timeline
- 2026-06-08: patched: Fix merged into master branch
- 2026-06-19: advisory: Version 14.0.0 released
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD