CVE-2026-110234: Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture
Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives truncates and overwrites victim-owned files.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Local users on a system where a victim uses Elio through 1.13.0 are exposed. The attack targets files owned by the Elio user and requires the attacker to act on the same host.
What must an attacker do to exploit it?
The attacker needs to know the victim Elio process ID and pre-create a symbolic link at the predictable capture path. The victim must then preview media, fonts, or archives, causing Elio to truncate and overwrite the symlink target.
Does exploitation require user interaction?
Yes. A victim must initiate a preview of supported content, such as media, fonts, or archives. The attacker also needs local access and low-level privileges.