CVE-2026-62294: Flameshot Race Condition Vulnerability

CVE-2026-62294 Overview

CVE-2026-62294 is a time-of-check to time-of-use (TOCTOU) race condition [CWE-362] in Flameshot, an open source screenshot utility. Versions prior to 14.0.0 wrote screenshots to a predictable temporary file path through the Open With feature and followed symbolic links during the write operation. A local unprivileged attacker on the same machine can pre-plant a symlink at the predictable path and cause Flameshot to overwrite arbitrary files writable by the victim user with PNG data. The issue is resolved in Flameshot 14.0.0.

Critical Impact
Local unprivileged attackers can overwrite arbitrary files owned by the victim user, leading to data integrity loss and potential local privilege escalation depending on the target file.

Affected Products

Flameshot versions prior to 14.0.0
Linux, macOS, and Windows builds using the Open With feature
Multi-user systems where untrusted local accounts share the host

Discovery Timeline

2026-07-15 - CVE-2026-62294 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-62294

Vulnerability Analysis

The flaw resides in the Open With feature of Flameshot, implemented in src/tools/launcher/applauncherwidget.cpp. When a user selects Open With, Flameshot writes the captured screenshot to a temporary file at a predictable path before invoking the chosen external application. The write operation performs no atomic creation check and follows symbolic links at the target location.

Because the filename is predictable, a local attacker sharing the system can create a symbolic link at that path pointing to any file the victim user can write. When the victim triggers Open With, Flameshot resolves the symlink and writes PNG data into the linked target, corrupting or replacing the file contents.

The result is arbitrary file overwrite in the victim's security context. Attackers can target shell configuration files, cron entries, SSH authorized_keys, or application configuration files to escalate privileges within the user account.

Root Cause

The root cause is the use of a predictable temporary path combined with non-atomic file creation. The original code did not use QTemporaryFile, which generates unique, non-predictable filenames and creates the file with restrictive permissions in a single syscall. Without atomic creation, a race window exists between path selection and file write.

Attack Vector

Exploitation requires local access with an unprivileged account on the same host as the victim. The attacker pre-creates a symbolic link at the predictable temporary path, pointing to a target file writable by the victim. When the victim invokes Open With in Flameshot, the write follows the symlink and overwrites the target with screenshot data.

The patch commit 936716b introduces QTemporaryFile in the launcher widget to eliminate the predictable path:

cpp

 #include <QRegularExpression>
 #include <QStandardPaths>
 #include <QTabWidget>
+#include <QTemporaryFile>
 
 namespace {
 #if defined(Q_OS_WIN)

A parallel change updates the header src/tools/launcher/applauncherwidget.h:

 #endif
 
 #include <QMap>
+#include <QTemporaryFile>
 #include <QWidget>
 
 class QTabWidget;

Source: Flameshot commit 936716b

Detection Methods for CVE-2026-62294

Indicators of Compromise

Unexpected symbolic links in shared temporary directories such as /tmp referencing user-owned files
PNG file signatures (\\x89PNG\r\n\\x1a\n) written into non-image files such as shell configs or authorized_keys
Flameshot processes writing to file paths outside the standard screenshot output directories

Detection Strategies

Audit filesystem events with auditd or eBPF to flag symlink creation followed by writes from the flameshot process
Monitor for Flameshot process file descriptors resolving through symlinks in world-writable directories
Baseline installed Flameshot versions across endpoints and alert on versions below 14.0.0

Monitoring Recommendations

Enable file integrity monitoring on user-writable sensitive files (~/.bashrc, ~/.ssh/authorized_keys, ~/.config/)
Log and review openat() syscalls with O_NOFOLLOW denials from the Flameshot binary
Correlate local user symlink activity in /tmp with subsequent Flameshot execution events

How to Mitigate CVE-2026-62294

Immediate Actions Required

Upgrade Flameshot to version 14.0.0 or later on all systems where it is installed
Inventory endpoints for vulnerable Flameshot installations, prioritizing multi-user Linux hosts
Restrict the use of shared temporary directories through per-user tmp namespaces where feasible

Patch Information

The fix is included in Flameshot v14.0.0 via Pull Request #4716. Details are documented in GitHub Security Advisory GHSA-fqqf-4rj8-c392. The patch replaces predictable temporary path handling with QTemporaryFile to ensure atomic creation with unique filenames.

Workarounds

Avoid using the Open With feature in Flameshot until the upgrade is applied
Mount /tmp with nosymfollow on Linux kernels that support the option to prevent symlink traversal
Enforce fs.protected_symlinks=1 via sysctl to block symlink following across UID boundaries in sticky-bit directories

bash

# Enforce kernel-level symlink protection
sudo sysctl -w fs.protected_symlinks=1
echo 'fs.protected_symlinks=1' | sudo tee -a /etc/sysctl.d/99-symlink-protection.conf

# Verify installed Flameshot version
flameshot --version