Read the docs
TI-2026-73450 Aliases CVE-2026-110234GHSA-h249-j3v7-74fw

Insecure temporary files in Elio let local users overwrite files

Priority LOW 18CWE-377Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Elio through 1.13.0 creates temporary capture files at predictable paths for external preview commands. A local user with low privileges can pre-create symbolic links at those paths (CWE-377), so previewing media, fonts or archives truncates and overwrites files owned by the victim. An attacker who knows the victim's Elio process ID can plant the link, and the victim must preview a file for the overwrite to occur.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elio-fmelioup to 1.13.0—No fix listedCNA
  • elio Vendorelio-fm Affected up to 1.13.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Elio.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-110234
  2. 2026-10-13 Alias added: GHSA-h249-j3v7-74fw
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences