CWE-377 · File and Path Handling
97CVEs
SortMost likely exploited
97 CVEs with CWE-377 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2015-5224The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.Kernel · Util-Linux · CVSS 9.8 · 2017-08-23 | 9.8 | 4.5% | 2017-08-23 |
| CVE-2026-20204Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk EnterpriseSplunk · Splunk Enterprise · CVSS 7.1 · 2026-04-15 | 7.1 | 3.2% | 2026-04-15 |
| CVE-2018-3710Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution.GitLab · GitLab Community and Enterprise Editions · 2018-03-21 | – | 2.8% | 2018-03-21 |
| CVE-2017-16024The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the se…HackerOne · sync-exec node module · 2018-06-04 | – | 2.5% | 2018-06-04 |
| CVE-2012-2666golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script.Golang · go/golang · 2021-07-09 | – | 1.9% | 2021-07-09 |
| CVE-2018-16494In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result in an arbitrary rea…Versa-Networks · Versa VOS · 2021-05-26 | – | 1.9% | 2021-05-26 |
| CVE-2011-4119caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.Inria · caml-light · 2021-10-26 | – | 1.9% | 2021-10-26 |
| CVE-2022-21809A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload.…InHand Networks · InRouter302 · CVSS 9.9 · 2022-05-12 | 9.9 | 1.8% | 2022-05-12 |
| CVE-2022-0736Insecure Temporary File in mlflow/mlflowmlflow · mlflow/mlflow · CVSS 8.2 · 2022-02-23 | 8.2 | 1.6% | 2022-02-23 |
| CVE-2013-4561In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.Redhat · openshift-origin-msg-node-mcollective · 2022-06-30 | – | 1.4% | 2022-06-30 |
| CVE-2017-20147In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writable by the smokeping user. By writing arbitrary PIDs to that…Smokeping · Smokeping · CVSS 6.5 · 2022-09-20 | 6.5 | 1.0% | 2022-09-20 |
| CVE-2023-43498In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with…Jenkins Project · Jenkins · 2023-09-20 | – | 1.0% | 2023-09-20 |
| CVE-2022-0315Insecure Temporary File in horovod/horovodhorovod · horovod/horovod · CVSS 8.2 · 2022-03-24 | 8.2 | 1.0% | 2022-03-24 |
| CVE-2018-25068devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp filedevent · globalpom-utils · CVSS 6.3 · 2023-01-06 | 6.3 | 0.9% | 2023-01-06 |
| CVE-2013-4253The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authorized_keys file.Redhat · Red Hat Openshift · CVSS 7.5 · 2022-10-19 | 7.5 | 0.7% | 2022-10-19 |
| CVE-2022-26386Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/t…Mozilla · Firefox ESR · CVSS 6.5 · 2022-12-22 | 6.5 | 0.7% | 2022-12-22 |
| CVE-2024-23287A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to ac…Apple · iOS and iPadOS · CVSS 6.5 · 2024-03-08 | 6.5 | 0.7% | 2024-03-08 |
| CVE-2018-6706McAfee Agent (MA) non-Windows versions incorrect use of temporary file vulnerabilityMcAfee · McAfee Agent (MA) for Linux · CVSS 2.3 · 2018-12-12 | 2.3 | 0.6% | 2018-12-12 |
| CVE-2022-3969OpenKM FileUtils.java getFileExtension temp fileOpenkm · OpenKM · CVSS 2.6 · 2022-11-13 | 2.6 | 0.6% | 2022-11-13 |
| CVE-2020-2016PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalationPalo Alto Networks · PAN-OS · CVSS 7 · 2020-05-13 | 7.0 | 0.6% | 2020-05-13 |
| CVE-2022-4817centic9 jgit-cookbook temp filecentic9 · jgit-cookbook · CVSS 3.1 · 2022-12-28 | 3.1 | 0.6% | 2022-12-28 |
| CVE-2021-29429Information disclosure through temporary directory permissionsgradle · gradle · CVSS 4 · 2021-04-12 | 4.0 | 0.5% | 2021-04-12 |
| CVE-2018-1053In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containi…The PostgreSQL Global Development Group · postgresql · 2018-02-09 | – | 0.5% | 2018-02-09 |
| CVE-2018-19637Static temporary filename allows overwriting of filesSUSE · supportutils · CVSS 2.8 · 2019-03-05 | 2.8 | 0.5% | 2019-03-05 |
| CVE-2026-20649A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.8.2, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3. A use…Apple · iOS and iPadOS · CVSS 5.5 · 2026-02-11 | 5.5 | 0.5% | 2026-02-11 |
| CVE-2020-35451Oozie local privilege escalationApache Software Foundation · Apache Oozie · 2021-03-09 | – | 0.4% | 2021-03-09 |
| CVE-2016-9595A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link a…Foreman · katello-debug · CVSS 7.3 · 2018-07-27 | 7.3 | 0.4% | 2018-07-27 |
| CVE-2020-1733A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs t…Red Hat · Ansible · CVSS 5 · 2020-03-11 | 5.0 | 0.4% | 2020-03-11 |
| CVE-2018-19638User can overwrite arbitrary log files in support tarSUSE · supportutils · CVSS 2.2 · 2019-03-05 | 2.2 | 0.4% | 2019-03-05 |
| CVE-2026-40635Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerab…Dell · PowerScale OneFS · CVSS 5.4 · 2026-09-09 | 5.4 | 0.4% | 2026-09-09 |
| CVE-2017-15111keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.jdennis · keycloak-httpd-client-install · 2018-01-20 | – | 0.4% | 2018-01-20 |
| CVE-2018-6705McAfee Agent (MA) for Linux Privilege Escalation vulnerabilityMcAfee · McAfee Agent (MA) for Linux · CVSS 2.3 · 2018-12-12 | 2.3 | 0.4% | 2018-12-12 |
| CVE-2018-6704McAfee Agent for Linux Privilege Escalation vulnerabilityMcAfee · McAfee Agent (MA) for Linux · CVSS 4.7 · 2018-12-12 | 4.7 | 0.4% | 2018-12-12 |
| CVE-2020-1981PAN-OS: Predictable temporary filename vulnerability allows local privilege escalationPalo Alto Networks · PAN-OS · CVSS 7 · 2020-03-11 | 7.0 | 0.4% | 2020-03-11 |
| CVE-2026-75920phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIPthorsten · phpMyFAQ · CVSS 5.3 · 2026-08-19 | 5.3 | 0.4% | 2026-08-19 |
| CVE-2025-14307Insecure Temporary File Creation in Robocode's AutoExtract ComponentRobocode Project · Robocode · CVSS 9.3 · 2025-12-09 | 9.3 | 0.4% | 2025-12-09 |
| CVE-2020-8032Local privilege escalation to root due to insecure tmp file usageopenSUSE · Factory · CVSS 6.7 · 2021-02-25 | 6.7 | 0.4% | 2021-02-25 |
| CVE-2020-1740A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the…Red Hat · ansible · CVSS 3.9 · 2020-03-16 | 3.9 | 0.4% | 2020-03-16 |
| CVE-2017-7549A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat Op…Red Hat, Inc. · instack-undercloud · 2017-09-21 | – | 0.4% | 2017-09-21 |
| CVE-2026-47852Predictable cache directory location allows local ONNX model substitution in Spring AISpring · Spring AI · CVSS 7.5 · 2026-08-26 | 7.5 | 0.3% | 2026-08-26 |
| CVE-2021-25316Local DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-toolsSUSE · SUSE Linux Enterprise Server 12-SP5 · CVSS 3.3 · 2021-04-14 | 3.3 | 0.3% | 2021-04-14 |
| CVE-2018-17955Static tempfile name allows overwriting of arbitrary filesSUSE · yast2-multipath · CVSS 2.2 · 2019-03-15 | 2.2 | 0.3% | 2019-03-15 |
| CVE-2020-8027openldap uses fixed paths in /tmpSUSE · SUSE Linux Enterprise Server 15-LTSS · CVSS 7.3 · 2021-02-11 | 7.3 | 0.3% | 2021-02-11 |
| CVE-2018-19640Code execution if run with command line switch -vSUSE · supportutils · CVSS 4.4 · 2019-03-05 | 4.4 | 0.3% | 2019-03-05 |
| CVE-2021-20202A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker…Redhat · keycloak · 2021-05-12 | – | 0.3% | 2021-05-12 |
| CVE-2023-2800Insecure Temporary File in huggingface/transformershuggingface · huggingface/transformers · CVSS 4.7 · 2023-05-18 | 4.7 | 0.3% | 2023-05-18 |
| CVE-2024-10372chidiwilliams buzz model_loader.py download_model temp filechidiwilliams · buzz · CVSS 4.5 · 2024-10-25 | 4.5 | 0.3% | 2024-10-25 |
| CVE-2020-1991Traps: Insecure temporary file vulnerability may allow privilege escalation on WindowsPalo Alto Networks · Traps · CVSS 7.8 · 2020-04-08 | 7.8 | 0.3% | 2020-04-08 |
| CVE-2026-49134CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp Filesteipete · CodexBar · CVSS 7.1 · 2026-06-01 | 7.1 | 0.3% | 2026-06-01 |
| CVE-2017-7560It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes.Red Hat, Inc. · rhnsd · 2017-09-13 | – | 0.3% | 2017-09-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.