Flameshot's screenshot software writes image files to a temporary location that is predictable and resolves symbolic links, creating a time‑of‑check to time‑of‑use race. An attacker who can run on the same local machine can pre‑create a symlink to any file that the victim user can write; when the victim selects the Open With feature in Flameshot, the photo is written through that link, overwriting the target file. This allows arbitrary file overwrite, potentially damaging configuration or log files. The weakness is a race condition (CWE‑362) and improper handling of temporary files (CWE‑377).

All users of Flameshot versions prior to 14.0.0 are affected. The flaw exists in the Open With feature and was fixed in release 14.0.0.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. The attack requires local, unprivileged access to the same machine; an attacker must first run Flameshot on the target system and because the payload is only written after user interaction, the risk is lower than remote‑code‑execution vectors, but the potential for arbitrary file corruption remains, especially in environments where the user can overwrite configuration or log files.