The example python script src/VBox/Frontends/VBoxShell/vboxshell.py

[ra]

The example python script src/VBox/Frontends/VBoxShell/vboxshell.py, has the ability to save screen-shots. When no file-name for a screen-shot the takeScreenshot function writes the screen-shot to "/tmp/screenshot.png". Potentially "/tmp/screenshot.png" could be a symbolic link to another file. The other file would be over-written if a user saved a screen-shot without specifying the file-name.

[Frank Mehnert]

That is correct but only a minor issue and definitely not a security issue, perhaps rather a not-so-obvious behavior.

[ra]

Sure, it isn't a real security issue - just some avoidable silliness.