{"id":"CVE-2026-110234","aliases":["EUVD-2026-99018","GHSA-h249-j3v7-74fw"],"status":"published","title":"Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture","description":"Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.","severity":{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00138,"percentile":0.03258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-377"],"published":"2026-10-13T18:50:16Z","modified":"2026-10-28T02:30:26Z","products":[{"vendor":"elio-fm","product":"elio"}],"references":[{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/r1d_wQojfg","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L14-L47","tags":["technical-description","article"]},{"url":"https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L92-L95","tags":["technical-description","article"]},{"url":"https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/archives/external_tools.rs#L30-L45","tags":["technical-description","article"]},{"url":"https://github.com/elio-fm/elio/releases/tag/v1.13.0","tags":["release-notes","advisory"]},{"url":"https://www.vulncheck.com/advisories/elio-through-1.13.0-insecure-temporary-file-creation-in-external-preview-command-capture","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110234","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h249-j3v7-74fw"},{"url":"https://crates.io","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110234.json","tags":["advisory"]},{"url":"https://github.com/elio-fm/elio","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-110234","title":"Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture","description":"Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.","status":"published","published":"2026-10-13T18:50:16.051Z","modified":"2026-10-14T15:57:13.139Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-99018","description":"Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.","status":"published","published":"2026-10-13T18:50:16Z","modified":"2026-10-14T15:57:13Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:14.734034Z"}],"ghsa":[{"id":"GHSA-h249-j3v7-74fw","title":"Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to...","description":"Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.","status":"published","published":"2026-10-13T21:33:40Z","modified":"2026-10-13T21:33:41Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:13:13.94868Z"}],"nvd":[{"id":"CVE-2026-110234","description":"Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.","status":"published","published":"2026-10-13T19:18:48.48Z","modified":"2026-10-14T16:17:40.66Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:12:57.132005Z"}],"osv":[{"id":"CVE-2026-110234","title":"Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture","description":"Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.","status":"published","published":"2026-10-13T18:50:16.051Z","modified":"2026-10-28T02:30:26.732972583Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:44:55.61515Z"}]}}