Insecure Temporary File Vulnerability in Elio Software by Elio FM
CVE-2026-110234

4.1MEDIUM

Key Information:

Vendor

Elio-fm

Status
Elio
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110234?

Elio software through version 1.13.0 is susceptible to an insecure temporary file vulnerability. This flaw allows local users to exploit the system by creating symbolic links at predictable paths. By knowing another user's Elio process ID, an attacker can plant a symlink, leading to the truncation and overwriting of files owned by the victim when previewing media, fonts, or archives. This poses significant risks to user data integrity and privacy.

Affected Version(s)

elio 0 <= 1.13.0

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/r1d_wQojfg
third-party-advisory
https://github.com/elio-fm/elio/blob/e7daae44ce748310de44...
technical-description
https://github.com/elio-fm/elio/blob/e7daae44ce748310de44...
technical-description

CVSS V4

Score:
4.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.