CWE-377
Allowed-with-ReviewInsecure Temporary File
Abstraction: Class · Status: Incomplete
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
200 vulnerabilities reference this CWE, most recent first.
GHSA-9295-MHF3-V33M
Vulnerability from github – Published: 2021-03-29 18:25 – Updated: 2023-08-08 19:54ID: NFLX-2021-001 Title: Local information disclosure in Hollow Release Date: 2021-03-23 Credit: Security Researcher @JLLeitschuh
Overview
Security researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.
Impact
An attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.
Description
Since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.
Workarounds and Fixes
Avoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.netflix.hollow:hollow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-28099"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-24T23:39:18Z",
"nvd_published_at": "2021-03-23T21:15:00Z",
"severity": "MODERATE"
},
"details": "\u003e ID: NFLX-2021-001\n\u003e Title: Local information disclosure in Hollow\n\u003e Release Date: 2021-03-23\n\u003e Credit: Security Researcher @JLLeitschuh\n\n# Overview\n\nSecurity researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.\n\n# Impact\n\nAn attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.\n\n# Description\n\nSince the `Files.exists(parent)` is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.\n\n# Workarounds and Fixes\n\nAvoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.",
"id": "GHSA-9295-mhf3-v33m",
"modified": "2023-08-08T19:54:40Z",
"published": "2021-03-29T18:25:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-j83w-7qr9-wv86"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28099"
},
{
"type": "WEB",
"url": "https://github.com/Netflix/hollow/issues/502"
},
{
"type": "WEB",
"url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-001.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insecure temporary file in Netflix OSS Hollow"
}
GHSA-9424-VJ6G-H5M7
Vulnerability from github – Published: 2026-08-13 15:34 – Updated: 2026-08-13 15:34A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.
{
"affected": [],
"aliases": [
"CVE-2026-73585"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T13:19:18Z",
"severity": "MODERATE"
},
"details": "A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.",
"id": "GHSA-9424-vj6g-h5m7",
"modified": "2026-08-13T15:34:37Z",
"published": "2026-08-13T15:34:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73585"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-73585"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462235"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9645-6G72-2PV8
Vulnerability from github – Published: 2022-05-17 05:44 – Updated: 2024-02-09 19:06libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"events": [
{
"introduced": "2.11.0"
},
{
"fixed": "2.11.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2008-7252"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-09T19:06:40Z",
"nvd_published_at": "2010-01-19T16:30:00Z",
"severity": "HIGH"
},
"details": "`libraries/File.class.php` in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors.",
"id": "GHSA-9645-6g72-2pv8",
"modified": "2024-02-09T19:06:40Z",
"published": "2022-05-17T05:44:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-7252"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpmyadmin/composer"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20100613071447/http://secunia.com/advisories/38211"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20100613071509/http://secunia.com/advisories/39503"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20110729050522/http://www.securityfocus.com/bid/37826"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"type": "WEB",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11528\u0026r2=11527\u0026pathrev=11528"
},
{
"type": "WEB",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11528"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"type": "WEB",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-2.php"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "phpMyAdmin unsafely handles temporary files"
}
GHSA-9GCF-PQ99-RJW3
Vulnerability from github – Published: 2022-05-17 01:27 – Updated: 2026-05-29 20:48The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "rply"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-1604"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-16T22:49:38Z",
"nvd_published_at": "2014-01-28T00:55:00Z",
"severity": "LOW"
},
"details": "The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.",
"id": "GHSA-9gcf-pq99-rjw3",
"modified": "2026-05-29T20:48:18Z",
"published": "2022-05-17T01:27:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1604"
},
{
"type": "WEB",
"url": "https://github.com/alex/rply/commit/fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90593"
},
{
"type": "PACKAGE",
"url": "https://github.com/alex/rply"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/rply/PYSEC-2014-117.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/rply/PYSEC-2014-17.yaml"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/01/17/8"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/01/18/4"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "RPLY Predictable Tmpfile Names Allows Cache Spoofing"
}
GHSA-9QJ7-JVG4-QR2X
Vulnerability from github – Published: 2017-10-24 18:33 – Updated: 2023-07-05 18:50Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "passenger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "passenger"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.1"
},
{
"fixed": "4.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-2119"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:29:24Z",
"nvd_published_at": "2014-01-03T18:54:00Z",
"severity": "MODERATE"
},
"details": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in `/tmp/` before it is used by the gem.",
"id": "GHSA-9qj7-jvg4-qr2x",
"modified": "2023-07-05T18:50:18Z",
"published": "2017-10-24T18:33:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2119"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2013:1136"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2013-2119"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-9qj7-jvg4-qr2x"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2013-2119.yml"
},
{
"type": "WEB",
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released"
},
{
"type": "WEB",
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1136.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Phusion Passenger Denial of Service"
}
GHSA-9RFJ-VJC2-F7CJ
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 configuration This issue affects: SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.37.1. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.37.1. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.18.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.9.1.
{
"affected": [],
"aliases": [
"CVE-2020-8027"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-11T16:15:00Z",
"severity": "MODERATE"
},
"details": "A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 configuration This issue affects: SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.37.1. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.37.1. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.18.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.9.1.",
"id": "GHSA-9rfj-vjc2-f7cj",
"modified": "2022-05-24T17:41:54Z",
"published": "2022-05-24T17:41:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8027"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1175568"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9W3X-J3R6-V2JC
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes.
{
"affected": [],
"aliases": [
"CVE-2017-7560"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-13T17:29:00Z",
"severity": "MODERATE"
},
"details": "It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes.",
"id": "GHSA-9w3x-j3r6-v2jc",
"modified": "2022-05-13T01:36:16Z",
"published": "2022-05-13T01:36:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7560"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1480550"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C2W5-VF7F-HRGH
Vulnerability from github – Published: 2026-10-14 03:30 – Updated: 2026-10-14 03:30Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.
This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A.
{
"affected": [],
"aliases": [
"CVE-2026-82715"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T02:17:00Z",
"severity": "HIGH"
},
"details": "Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.\n\nThis issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A.",
"id": "GHSA-c2w5-vf7f-hrgh",
"modified": "2026-10-14T03:30:39Z",
"published": "2026-10-14T03:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82715"
},
{
"type": "WEB",
"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-137/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C4MC-49HQ-Q275
Vulnerability from github – Published: 2022-05-14 00:56 – Updated: 2023-08-29 21:02Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "puppet"
},
"ranges": [
{
"events": [
{
"introduced": "2.6"
},
{
"fixed": "2.6.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "puppet"
},
"ranges": [
{
"events": [
{
"introduced": "2.7"
},
{
"fixed": "2.7.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-1906"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-29T21:02:11Z",
"nvd_published_at": "2012-05-29T20:55:00Z",
"severity": "MODERATE"
},
"details": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.",
"id": "GHSA-c4mc-49hq-q275",
"modified": "2023-08-29T21:02:11Z",
"published": "2022-05-14T00:56:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1906"
},
{
"type": "WEB",
"url": "https://github.com/puppetlabs/puppet/commit/f7829ec1f1b2c3def8e0eda09c22c3c1fed3a27f"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1906.yml"
},
{
"type": "WEB",
"url": "https://ubuntu.com/usn/usn-1419-1"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2012/dsa-2451"
},
{
"type": "WEB",
"url": "http://projects.puppetlabs.com/issues/13260"
},
{
"type": "WEB",
"url": "http://puppetlabs.com/security/cve/cve-2012-1906"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Puppet uses predictable filenames, allowing arbitrary file overwrite"
}
GHSA-CM3C-7FFR-R2CR
Vulnerability from github – Published: 2022-10-19 19:00 – Updated: 2022-10-21 19:01The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authorized_keys file.
{
"affected": [],
"aliases": [
"CVE-2013-4253"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-19T18:15:00Z",
"severity": "HIGH"
},
"details": "The deployment script in the unsupported \"OpenShift Extras\" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user\u0027s authorized_keys file.",
"id": "GHSA-cm3c-7ffr-r2cr",
"modified": "2022-10-21T19:01:13Z",
"published": "2022-10-19T19:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4253"
},
{
"type": "WEB",
"url": "https://github.com/openshift/openshift-extras/blob/enterprise-2.0/README.md#security-notice"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2014/06/05/19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-149: Explore for Predictable Temporary File Names
An attacker explores a target to identify the names and locations of predictable temporary files for the purpose of launching further attacks against the target. This involves analyzing naming conventions and storage locations of the temporary files created by a target application. If an attacker can predict the names of temporary files they can use this information to mount other attacks, such as information gathering and symlink attacks.
CAPEC-155: Screen Temporary Files for Sensitive Information
An adversary exploits the temporary, insecure storage of information by monitoring the content of files used to store temp data during an application's routine execution flow. Many applications use temporary files to accelerate processing or to provide records of state across multiple executions of the application. Sometimes, however, these temporary files may end up storing sensitive information. By screening an application's temporary files, an adversary might be able to discover such sensitive information. For example, web browsers often cache content to accelerate subsequent lookups. If the content contains sensitive information then the adversary could recover this from the web cache.