CWE-379 Creation of Temporary File in Directory with Insecure Permissions
Description
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-379 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-jfgx-wxx8-mp94 | CVE-2026-54328 | HIGH |
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts |
2026-07-20 | |
| GHSA-4625-4j76-fww9 | CVE-2026-42191 | MODERATE |
OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter |
2026-05-13 | |
| GHSA-6w46-j5rx-g56g | CVE-2025-71176 | MODERATE |
pytest has vulnerable tmpdir handling |
2026-04-13 | |
| GHSA-4x5p-f36r-mxxr | CVE-2025-10279 | HIGH |
mlflow Creates of Temporary File in Directory with Insecure Permissions |
2026-02-02 | |
| GHSA-7g45-4rm6-3mm3 | CVE-2023-2976 | MODERATE |
Guava vulnerable to insecure use of temporary directory |
2025-11-04 | |
| GHSA-jmgm-gx32-vp4w | CVE-2024-12911 | HIGH |
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions |
2025-03-21 | |
| GHSA-9w2p-rh8c-v9g5 | CVE-2023-49797 | HIGH |
Local Privilege Escalation in Windows |
2024-11-22 | |
| GHSA-rcjj-h6gh-jf3r | CVE-2020-17521 | MODERATE |
Information Disclosure in Apache Groovy |
2024-10-17 | |
| GHSA-wxvp-8q8h-r6rr | CVE-2011-4293 | MODERATE | - |
Moodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory |
2024-01-17 |
| GHSA-g3wg-6mcf-8jj6 | CVE-2020-27216 | HIGH |
Local Temp Directory Hijacking Vulnerability |
2023-11-27 | |
| GHSA-23x4-m842-fmwf | CVE-2021-21428 | CRITICAL |
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator |
2023-06-30 | |
| GHSA-cqxr-xf2w-943w | CVE-2021-21430 | MODERATE |
Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code |
2022-10-25 | |
| GHSA-cm59-pr5q-cw85 | CVE-2022-27772 | HIGH |
Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot |
2022-07-11 | |
| GHSA-269q-hmxg-m83q | CVE-2022-24823 | MODERATE |
Local Information Disclosure Vulnerability in io.netty:netty-codec-http |
2022-05-10 | |
| GHSA-5mcr-gq6c-3hq2 | CVE-2021-21290 | MODERATE |
Local Information Disclosure Vulnerability in Netty on Unix-Like systems |
2022-04-19 | |
| GHSA-c57f-4vp2-jqhm | - | MODERATE |
Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 |
2021-10-05 | |
| GHSA-2cxf-6567-7pp6 | CVE-2021-21331 | LOW |
Local Information Disclosure Vulnerability |
2021-07-08 | |
| GHSA-p826-8vhq-h439 | CVE-2021-31411 | HIGH |
Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 |
2021-05-19 | |
| GHSA-867q-77cc-98mv | CVE-2021-21429 | MODERATE |
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin |
2021-05-10 | |
| GHSA-c43q-5hpj-4crv | CVE-2021-28168 | MODERATE |
Local information disclosure via system temporary directory |
2021-04-22 | |
| GHSA-pc22-3g76-gm6j | CVE-2021-21363 | LOW |
Generator Web Application: Local Privilege Escalation Vulnerability via System Temp Directory |
2021-03-22 |