CVE-2026-110234: Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-14
Weakness: CWE-377

Description

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.

Affected products

elio-fm elio: through 1.13.0

References

https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/archives/external_tools.rs#L30-L45
https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L14-L47
https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L92-L95
https://github.com/elio-fm/elio/releases/tag/v1.13.0
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/r1d_wQojfg
https://www.vulncheck.com/advisories/elio-through-1.13.0-insecure-temporary-file-creation-in-external-preview-command-capture

Get alerted when CVE-2026-110234 or the next vulnerability affects your stack