flameshot-org CVE debriefs

CVE-2026-62294

A local unprivileged attacker on the same machine can exploit Flameshot's Open With feature prior to version 14.0.0 to overwrite any file the victim user could write by pre-planting a symlink. This issue arises from a time-of-check to time-of-use race condition that allows an attacker to manipulate the file system. Defenders should be aware of the potential for local attackers to overwrite sensitive files [truncated]