Common Weakness Enumeration

CWE-378 Creation of Temporary File With Insecure Permissions

Description

Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-378 ordered by modification date.

20 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-f2m9-wcf4-cwwx	CVE-2026-4137	HIGH	pypi/mlflow	MLFlow Creates a Temporary File With Insecure Permissions	2026-09-01
GHSA-9q8j-chc7-wpgp	-	MODERATE	npm/openclaw	Duplicate Advisory: OpenClaw session transcript files were created without forced user-only permissions	2026-04-06
GHSA-5mg8-w23w-74h3	CVE-2020-8908	LOW	maven/com.google.guava/guava	Information Disclosure in Guava	2026-02-23
GHSA-m68q-4hqr-mc6f	CVE-2025-4953	HIGH	golang/github.com/containers/podman/v5	Podman Creates Temporary File with Insecure Permissions	2026-01-15
GHSA-cr7q-2w66-hjcm	CVE-2025-7647	HIGH	pypi/llama-index-core	llama-index-core insecurely handles temporary files	2025-09-29
GHSA-f5fw-25gw-5m92	CVE-2024-23454	LOW	maven/org.apache.hadoop/hadoop-common	Apache Hadoop: Temporary File Local Information Disclosure	2025-09-05
GHSA-2c6g-pfx3-w7h8	CVE-2023-0482	MODERATE	maven/org.jboss.resteasy/resteasy-core maven/org.jboss.resteasy/resteasy-multipart-provider	Insecure Temporary File in RESTEasy	2025-01-15
GHSA-jrmh-v64j-mjm9	-	MODERATE	maven/org.jboss.resteasy/resteasy-core maven/org.jboss.resteasy/resteasy-multipart-provider	Duplicate Advisory: Insecure Temporary File in RESTEasy	2025-01-15
GHSA-g5m2-22h2-rr3j	CVE-2014-1839	MODERATE	pypi/logilab-common	Creation of Temporary File With Insecure Permissions in logilab-commons	2024-09-30
GHSA-g3wg-6mcf-8jj6	CVE-2020-27216	HIGH	maven/org.eclipse.jetty/jetty-webapp maven/org.mortbay.jetty/jetty-webapp	Local Temp Directory Hijacking Vulnerability	2023-11-27
GHSA-23x4-m842-fmwf	CVE-2021-21428	CRITICAL	maven/org.openapitools/openapi-generator-online	Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator	2023-06-30
GHSA-j75r-vf64-6rrh	CVE-2023-0481	LOW	maven/io.quarkus.resteasy.reactive/resteasy-reactive-common	RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions	2023-03-07
GHSA-hpv8-9rq5-hq7w	CVE-2021-21364	MODERATE	maven/io.swagger/swagger-codegen	Generated Code Contains Local Information Disclosure Vulnerability	2022-10-25
GHSA-cqxr-xf2w-943w	CVE-2021-21430	MODERATE	maven/org.openapitools/openapi-generator	Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code	2022-10-25
GHSA-269q-hmxg-m83q	CVE-2022-24823	MODERATE	maven/io.netty/netty-codec-http	Local Information Disclosure Vulnerability in io.netty:netty-codec-http	2022-05-10
GHSA-5mcr-gq6c-3hq2	CVE-2021-21290	MODERATE	maven/io.netty/netty maven/io.netty/netty-codec-http maven/org.jboss.netty/netty	Local Information Disclosure Vulnerability in Netty on Unix-Like systems	2022-04-19
GHSA-2cxf-6567-7pp6	CVE-2021-21331	LOW	maven/com.datadoghq/datadog-api-client	Local Information Disclosure Vulnerability	2021-07-08
GHSA-867q-77cc-98mv	CVE-2021-21429	MODERATE	maven/org.openapitools/openapi-generator-maven-plugin	Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin	2021-05-10
GHSA-c43q-5hpj-4crv	CVE-2021-28168	MODERATE	maven/org.glassfish.jersey.core/jersey-common	Local information disclosure via system temporary directory	2021-04-22
GHSA-pc22-3g76-gm6j	CVE-2021-21363	LOW	maven/io.swagger/swagger-codegen	Generator Web Application: Local Privilege Escalation Vulnerability via System Temp Directory	2021-03-22