CWE-377
Allowed-with-ReviewInsecure Temporary File
Abstraction: Class · Status: Incomplete
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
185 vulnerabilities reference this CWE, most recent first.
GHSA-PH92-W482-M4JJ
Vulnerability from github – Published: 2024-03-11 00:30 – Updated: 2024-03-11 00:30If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.
{
"affected": [],
"aliases": [
"CVE-2024-2313"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-10T23:15:53Z",
"severity": "LOW"
},
"details": "If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.",
"id": "GHSA-ph92-w482-m4jj",
"modified": "2024-03-11T00:30:45Z",
"published": "2024-03-11T00:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2313"
},
{
"type": "WEB",
"url": "https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998"
},
{
"type": "WEB",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PV57-6VH7-F36C
Vulnerability from github – Published: 2025-11-13 21:31 – Updated: 2025-11-13 21:31Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
{
"affected": [],
"aliases": [
"CVE-2025-46368"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-13T20:15:49Z",
"severity": "MODERATE"
},
"details": "Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.",
"id": "GHSA-pv57-6vh7-f36c",
"modified": "2025-11-13T21:31:19Z",
"published": "2025-11-13T21:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46368"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-Q37P-CXJ4-XGFV
Vulnerability from github – Published: 2025-11-13 21:31 – Updated: 2025-11-13 21:31Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
{
"affected": [],
"aliases": [
"CVE-2025-46369"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-13T20:15:50Z",
"severity": "HIGH"
},
"details": "Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.",
"id": "GHSA-q37p-cxj4-xgfv",
"modified": "2025-11-13T21:31:19Z",
"published": "2025-11-13T21:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46369"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q4HM-FWC9-HMV6
Vulnerability from github – Published: 2021-06-16 17:53 – Updated: 2022-04-18 21:55This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.squareup:connect"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.20191120.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23331"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-22T22:46:28Z",
"nvd_published_at": "2021-02-03T18:15:00Z",
"severity": "LOW"
},
"details": "This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.",
"id": "GHSA-q4hm-fwc9-hmv6",
"modified": "2022-04-18T21:55:54Z",
"published": "2021-06-16T17:53:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23331"
},
{
"type": "PACKAGE",
"url": "https://github.com/square/connect-java-sdk"
},
{
"type": "WEB",
"url": "https://github.com/square/connect-java-sdk/blob/master/src/main/java/com/squareup/connect/ApiClient.java%23L613"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-COMSQUAREUP-1065988"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insecure temporary file used in com.squareup:connect"
}
GHSA-Q78X-RRX8-5M7Q
Vulnerability from github – Published: 2022-04-22 00:24 – Updated: 2022-04-22 00:24caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
{
"affected": [],
"aliases": [
"CVE-2011-4119"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-26T13:15:00Z",
"severity": "CRITICAL"
},
"details": "caml-light \u003c= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.",
"id": "GHSA-q78x-rrx8-5m7q",
"modified": "2022-04-22T00:24:29Z",
"published": "2022-04-22T00:24:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4119"
},
{
"type": "WEB",
"url": "https://seclists.org/oss-sec/2011/q4/249"
},
{
"type": "WEB",
"url": "https://vuxml.freebsd.org/freebsd/9dde9dac-08f4-11e1-af36-003067b2972c.html"
},
{
"type": "WEB",
"url": "http://gnats.netbsd.org/45558"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QXXC-7MQ4-MF79
Vulnerability from github – Published: 2023-01-12 06:30 – Updated: 2023-01-20 22:03Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.util:java-merge-sort"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24913"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-12T20:55:23Z",
"nvd_published_at": "2023-01-12T05:15:00Z",
"severity": "MODERATE"
},
"details": "Versions of the package `com.fasterxml.util:java-merge-sort` before 1.1.0 are vulnerable to Insecure Temporary File in the `StdTempFileProvider()` function in `StdTempFileProvider.java`, which uses the permissive `File.createTempFile()` function, exposing temporary file contents.",
"id": "GHSA-qxxc-7mq4-mf79",
"modified": "2023-01-20T22:03:35Z",
"published": "2023-01-12T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24913"
},
{
"type": "WEB",
"url": "https://github.com/cowtowncoder/java-merge-sort/pull/21"
},
{
"type": "WEB",
"url": "https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902"
},
{
"type": "PACKAGE",
"url": "https://github.com/cowtowncoder/java-merge-sort"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Java Merge-sort Insecure Temporary File vulnerability"
}
GHSA-R225-6X7C-4Q3H
Vulnerability from github – Published: 2025-09-29 18:33 – Updated: 2025-09-29 18:33bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.
{
"affected": [],
"aliases": [
"CVE-2025-61659"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-29T17:15:32Z",
"severity": "MODERATE"
},
"details": "bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.",
"id": "GHSA-r225-6x7c-4q3h",
"modified": "2025-09-29T18:33:13Z",
"published": "2025-09-29T18:33:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61659"
},
{
"type": "WEB",
"url": "https://github.com/magicmonty/bash-git-prompt/issues/561"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R35R-FPX2-JGR4
Vulnerability from github – Published: 2026-07-06 20:31 – Updated: 2026-07-06 20:31Summary
The SQLite databases are created at predictable (static) paths in /tmp. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target.
This becomes really dangerous for the scripts which can be executed as root with sudo. With this, an attacker can write to abitrary paths.
PoC
The docker-stats check command here as an example. Because writing to /tmp is the default behaviour, the other check commands which use a SQLite database are also very likely affected.
# Create the symlink as nagios user
nagios@test-server:/tmp$ ln -s /root/nagios-was-here /tmp/linuxfabrik-monitoring-plugins-docker-stats.db
# Trigger the execution nagios user
nagios@test-server:/tmp$ sudo /usr/lib64/nagios/plugins/docker-stats
Check whether or not file was created.
root@test-server:/# file /root/nagios-was-here
/root/nagios-was-here: SQLite 3.x database, last written using SQLite version 3046001, file counter 2, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Impact
In it's basic form, this vulnerbility can lead to a denial of service, impacting users who use the provided sudoers file and who didn't take any special precautions like systemd's PrivateTemp. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).
If any application on the server relies on a SQLite database, there are scenarios where this vulnerability allows for content in existing SQLite databases to be modified. An attacker could let the symlink point to an existing SQLite database and create in /tmp a specially-crafted SQLite Rollback Journal (.db-journal) or Write-Ahead-Log (.db-wal), which is then applied to the database.
Fix
A proposed fix would be to create a separate directory inside /tmp per user (e.g.,/tmp/linuxfabrik-monitoring-plugins-{os.geteuid()}). After creating this directory (or using an already existing one), check the following:
# Use os.lstat() instead of os.stat() so we don't accidentally follow symlinks
dir_stat = os.lstat(TMP_DIR_PATH)
# Ensure the directory is a real dir and not a Symlink
if not stat.S_ISDIR(dir_stat.st_mode):
# abort the execution
sys.exit(1)
# Verify the owner
if dir_stat.st_uid != os.getuid():
# abort the execution
sys.exit(1)
# Verify the permissions
if (dir_stat.st_mode & 0o077) != 0:
# abort the execution
sys.exit(1)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "linuxfabrik-lib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53759"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T20:31:43Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\nThe SQLite databases are created at predictable (static) paths in `/tmp`. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target.\nThis becomes really dangerous for the scripts which can be executed as root with sudo. With this, an attacker can write to abitrary paths.\n\n### PoC\nThe docker-stats check command here as an example. Because writing to /tmp is the default behaviour, the other check commands which use a SQLite database are also very likely affected.\n```\n# Create the symlink as nagios user\nnagios@test-server:/tmp$ ln -s /root/nagios-was-here /tmp/linuxfabrik-monitoring-plugins-docker-stats.db\n# Trigger the execution nagios user\nnagios@test-server:/tmp$ sudo /usr/lib64/nagios/plugins/docker-stats\n```\nCheck whether or not file was created.\n```\nroot@test-server:/# file /root/nagios-was-here\n/root/nagios-was-here: SQLite 3.x database, last written using SQLite version 3046001, file counter 2, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 2\n```\n\n### Impact\nIn it\u0027s basic form, this vulnerbility can lead to a denial of service, impacting users who use the provided sudoers file and who didn\u0027t take any special precautions like systemd\u0027s `PrivateTemp`. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).\n\nIf any application on the server relies on a SQLite database, there are scenarios where this vulnerability allows for content in existing SQLite databases to be modified. An attacker could let the symlink point to an existing SQLite database and create in /tmp a specially-crafted SQLite Rollback Journal (`.db-journal`) or Write-Ahead-Log (`.db-wal`), which is then applied to the database.\n\n### Fix\nA proposed fix would be to create a separate directory inside /tmp per user (e.g.,` /tmp/linuxfabrik-monitoring-plugins-{os.geteuid()}`). After creating this directory (or using an already existing one), check the following:\n```\n# Use os.lstat() instead of os.stat() so we don\u0027t accidentally follow symlinks\ndir_stat = os.lstat(TMP_DIR_PATH)\n\n# Ensure the directory is a real dir and not a Symlink\nif not stat.S_ISDIR(dir_stat.st_mode):\n # abort the execution\n sys.exit(1)\n\n# Verify the owner\nif dir_stat.st_uid != os.getuid():\n # abort the execution\n sys.exit(1)\n\n# Verify the permissions\nif (dir_stat.st_mode \u0026 0o077) != 0:\n # abort the execution\n sys.exit(1)\n```",
"id": "GHSA-r35r-fpx2-jgr4",
"modified": "2026-07-06T20:31:43Z",
"published": "2026-07-06T20:31:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4"
},
{
"type": "PACKAGE",
"url": "https://github.com/Linuxfabrik/monitoring-plugins"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases"
}
GHSA-R5HP-3CGJ-J6XV
Vulnerability from github – Published: 2026-04-28 09:34 – Updated: 2026-05-06 19:52In Spring AI, having access to a shared environment can expose the ONNX model used by the application.
Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.ai:spring-ai-transformers"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.ai:spring-ai-transformers"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40979"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T19:52:09Z",
"nvd_published_at": "2026-04-28T09:16:16Z",
"severity": "MODERATE"
},
"details": "In Spring AI, having access to a shared environment can expose the ONNX model used by the application.\n\nAffected versions:\nSpring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)",
"id": "GHSA-r5hp-3cgj-j6xv",
"modified": "2026-05-06T19:52:09Z",
"published": "2026-04-28T09:34:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40979"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-ai"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-40979"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Spring AI\u0027s ONNX model cache defaults to world-writable predictable /tmp directory"
}
GHSA-R5X9-XQ27-VVXH
Vulnerability from github – Published: 2026-01-07 12:31 – Updated: 2026-01-07 12:31Insecure Temporary File vulnerability in Altera Quartus Prime Standard
Installer (SFX)
on Windows, Altera Quartus Prime Lite
Installer (SFX)
on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1.
{
"affected": [],
"aliases": [
"CVE-2025-14614"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-07T12:16:55Z",
"severity": "MODERATE"
},
"details": "Insecure Temporary File vulnerability in Altera Quartus Prime Standard\u00a0\n\nInstaller (SFX)\n\n on Windows, Altera Quartus Prime Lite\u00a0\n\nInstaller (SFX)\n\n on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1.",
"id": "GHSA-r5x9-xq27-vvxh",
"modified": "2026-01-07T12:31:22Z",
"published": "2026-01-07T12:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14614"
},
{
"type": "WEB",
"url": "https://www.altera.com/security/security-advisory/asa-0005"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-149: Explore for Predictable Temporary File Names
An attacker explores a target to identify the names and locations of predictable temporary files for the purpose of launching further attacks against the target. This involves analyzing naming conventions and storage locations of the temporary files created by a target application. If an attacker can predict the names of temporary files they can use this information to mount other attacks, such as information gathering and symlink attacks.
CAPEC-155: Screen Temporary Files for Sensitive Information
An adversary exploits the temporary, insecure storage of information by monitoring the content of files used to store temp data during an application's routine execution flow. Many applications use temporary files to accelerate processing or to provide records of state across multiple executions of the application. Sometimes, however, these temporary files may end up storing sensitive information. By screening an application's temporary files, an adversary might be able to discover such sensitive information. For example, web browsers often cache content to accelerate subsequent lookups. If the content contains sensitive information then the adversary could recover this from the web cache.