elio-fm vulnerabilities and threats

Elio file manager versions up to 1.13.0 have an insecure temporary file vulnerability that allows local users to overwrite files owned by other users by creating symbolic links at predictable temporary file paths. This can lead to truncation and overwriting of victim-owned files when previewing media, fonts, or archives. The vulnerability requires knowledge of the victim's Elio process ID and local access to the system. The CVSS 4.0 base score is 4.1, indicating medium severity.