CVE-2026-110234

4.4 MEDIUMpublic exploit available

Published 2026-10-13 · Updated 2026-10-14

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Weaknesses

CWE-377

Public exploit & PoC references

https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/archives/external_tools.rs#L30-L45
https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L14-L47
https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L92-L95
https://github.com/elio-fm/elio/releases/tag/v1.13.0

All references

https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/archives/external_tools.rs#L30-L45
https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L14-L47
https://github.com/elio-fm/elio/blob/e7daae44ce748310de441499576bdc31b936d54c/src/preview/external_commands.rs#L92-L95
https://github.com/elio-fm/elio/releases/tag/v1.13.0
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/r1d_wQojfg
https://www.vulncheck.com/advisories/elio-through-1.13.0-insecure-temporary-file-creation-in-external-preview-command-capture

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-106451PoC
LOWCVE-2026-16791
UNSCOREDCVE-2026-49484PoC
UNSCOREDCVE-2026-54584PoC
MEDIUMCVE-2026-55480PoC
HIGHCVE-2026-79899
HIGHCVE-2026-82715

Related by shared AI tags and CWE weakness class. Browse the full archive.