cve.bz

CWE-377: Insecure Temporary File, page 2

Filter

deprecated by MITRE

This entry has been deprecated. It was focused only on the affected resource (temporary file) and not the behavior or mistake that produced the insecure temporary file, which caused confusion and incorrect mappings.

What the weakness is: CWE-377 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 2
  • CAPEC-149 Explore for Predictable Temporary File Names Severity: Medium
  • CAPEC-155 Screen Temporary Files for Sensitive Information Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-377, as MITRE names them. Credits.

Ask an AI about CWE-377

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-377: Insecure Temporary File and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/377.html and https://cve.bz/cve/cwe/377?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2025-7707EPSS 0.2%

    The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt N…

  2. 6.8CVE-2025-61659EPSS 0.1%

    bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.

  3. 8.5CVE-2025-34194EPSS 0.3%

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstall…

  4. 1.1CVE-2025-9474EPSS 0.1%

    A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with in…

  5. 3.9CVE-2015-0849EPSS 0.1%

    pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.

  6. 7.3CVE-2024-49506EPSS 0.10%

    Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem

  7. 2.0CVE-2024-10372EPSS 0.3%

    A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_loader.py. The manipulation leads to insecure temporary file. It is possible to …

  8. 6.8CVE-2024-6654EPSS 0.2%

    Products for macOS enables a user logged on to the system to perform a denial-of-service attack, which could be misused to disable the protection of the ESET security product and cause general system slow-down.

  9. 7.1CVE-2024-7358EPSS 0.2%

    A vulnerability was detected in Point B Ltd Getscreen Agent up to 2.19.6/3.9.4 on Windows. This affects an unknown function of the file getscreen.msi of the component MSI Installer. The manipulation results in creation of temporary file wi…

  10. 5.1CVE-2024-34490EPSS 0.2%

    In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attacker who can create files in advance with these names. This affects, for example,…

  11. 2.8CVE-2024-2313EPSS 0.2%

    If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers…

  12. 5.5CVE-2024-23287EPSS 0.7%

    A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to access user-sensitive data.

  13. 5.5CVE-2024-22236EPSS 0.2%

    In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permission…

  14. 7.8CVE-2023-49347EPSS 0.3%

    Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attacker…

  15. 7.8CVE-2023-49346EPSS 0.3%

    Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attack…

  16. 7.8CVE-2023-49345EPSS 0.3%

    Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attacke…

  17. 7.8CVE-2023-49344EPSS 0.3%

    Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. At…

  18. 7.8CVE-2023-49342EPSS 0.3%

    Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attacke…

  19. 8.1CVE-2023-43498EPSS 1.0%

    In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentiall…

  20. 4.7CVE-2023-2800EPSS 0.3%

    Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.

  21. 7.8CVE-2022-34387EPSS 0.2%

    Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilege escalation vulnerability. A local authenticated malicious user could potentially exploit this vuln…

  22. 5.5CVE-2022-24913EPSS 0.3%

    Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, …

  23. 9.8CVE-2018-25068EPSS 0.8%

    A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileres…

  24. 7.8CVE-2022-4817EPSS 0.6%

    A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to insecure temporary file. The attack can be initiated remotely. The name of the patc…

  25. 6.5CVE-2022-26386EPSS 0.7%

    Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be affected by other local users.…

  26. 5.5CVE-2022-4641EPSS 0.2%

    A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure te…

  27. 3.3CVE-2022-41954EPSS 0.2%

    MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being cr…

  28. 5.5CVE-2022-41946EPSS 0.6%

    pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the Inpu…

  29. 5.5CVE-2022-3969EPSS 0.6%

    A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary …

  30. 7.1CVE-2022-3952EPSS 0.6%

    A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary fil…

  31. 7.5CVE-2013-4253EPSS 0.7%

    The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authorized_keys file.

  32. 6.5CVE-2017-20147EPSS 1.0%

    In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writable by the smokeping user. By writing arbitrary PIDs to that file, the smokeping user can cause a denial of service to ar…

  33. 5.5CVE-2022-35631EPSS 0.2%

    On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.…

  34. 9.1CVE-2013-4561EPSS 1.4%

    In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.

  35. 8.1CVE-2022-21809EPSS 1.8%

    A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vuln…

  36. 5.5CVE-2021-22572EPSS 0.1%

    On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive infor…

  37. 7.5CVE-2022-0315EPSS 1.0%

    Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.

  38. 6.1CVE-2022-21945EPSS 0.2%

    A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior version…

  39. 4.4CVE-2021-46705EPSS 0.2%

    A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versio…

  40. 7.5CVE-2022-0736EPSS 1.6%

    Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.

  41. 9.8CVE-2011-4119EPSS 1.9%

    caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.

  42. 9.8CVE-2012-2666EPSS 1.9%

    golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script.

  43. 8.8CVE-2018-16494EPSS 1.9%

    In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result in an arbitrary read, write, or execution of newly created files and directorie…

  44. 7.3CVE-2021-20202EPSS 0.3%

    A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this…

  45. 3.3CVE-2021-25316EPSS 0.3%

    A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 …

  46. 5.5CVE-2021-29429EPSS 0.5%

    In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote…

  47. 4.7CVE-2020-35451EPSS 0.4%

    There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.

  48. 7.0CVE-2020-8032EPSS 0.4%

    A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.

  49. 4.4CVE-2020-8030EPSS 0.2%

    A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file before it is processed, leading to arbitrary modifications of the machine/cluster.

  50. 6.6CVE-2020-8027EPSS 0.3%

    A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain acce…