flameshot: Flameshot is powerful yet simple to use screenshot software
CVE-2026-62294 is fixed in flameshot on 1 platform by DEBIAN-CVE-2026-62294 (version 14.0.0-1), released July 18, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| flameshot · Debian 14 | 14.0.0-1 | DEBIAN-CVE-2026-62294 | Jul 18, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.