babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwrite arbitrary files.
CVSS 3.1MEDIUM 5.5·Local·No auth·User interaction·EPSS 0.00256·Published 2019-11-12·Fixed in 2.0.11CWE-494