CWE-378 · File and Path Handling
Creation of Temporary File With Insecure Permissions
43CVEs
SortMost likely exploited
43 CVEs with CWE-378 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-27216In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory…The Eclipse Foundation · Eclipse Jetty · 2020-10-23 | – | 4.4% | 2020-10-23 |
| CVE-2021-21290Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary filesnetty · netty · CVSS 6.2 · 2021-02-08 | 6.2 | 1.8% | 2021-02-08 |
| CVE-2016-9485On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can obtain administrator privileges on the endpoin…Microsoft · Windows SecureConnector agent · 2018-07-13 | – | 1.3% | 2018-07-13 |
| CVE-2020-8908Temp directory permission issue in GuavaGoogle LLC · Guava · CVSS 3.3 · 2020-12-10 | 3.3 | 0.9% | 2020-12-10 |
| CVE-2021-28168Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which create…The Eclipse Foundation · Eclipse Jersey · CVSS 6.2 · 2021-04-22 | 6.2 | 0.9% | 2021-04-22 |
| CVE-2021-25654Avaya Aura Device Services Arbitrary Code Execution VulnerabilityAvaya · Avaya Aura Devices Services · CVSS 6.2 · 2021-06-25 | 6.2 | 0.8% | 2021-06-25 |
| CVE-2025-4953Podman: build context bind mountRedhat · podman · CVSS 7.4 · 2025-09-16 | 7.4 | 0.7% | 2025-09-16 |
| CVE-2021-1496Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco · Cisco AnyConnect Secure Mobility Client · CVSS 7 · 2021-05-06 | 7.0 | 0.5% | 2021-05-06 |
| CVE-2024-39872A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created…Siemens · SINEMA Remote Connect Server · CVSS 9.6 · 2024-07-09 | 9.6 | 0.5% | 2024-07-09 |
| CVE-2024-23454Apache Hadoop: Temporary File Local Information DisclosureApache Software Foundation · Apache Hadoop · CVSS 6.2 · 2024-09-25 | 6.2 | 0.4% | 2024-09-25 |
| CVE-2021-25314hawk: Insecure file permissionsSUSE · SUSE Linux Enterprise High Availability 12-SP3 · CVSS 7.8 · 2021-04-14 | 7.8 | 0.4% | 2021-04-14 |
| CVE-2025-32979NETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users.Netscout · Ngeniusone · CVSS 6.5 · 2025-04-25 | 6.5 | 0.4% | 2025-04-25 |
| CVE-2024-7358Point B Ltd Getscreen Agent MSI Installer getscreen.msi temp filePoint B Ltd · Getscreen Agent · CVSS 7.8 · 2024-08-01 | 7.8 | 0.3% | 2024-08-01 |
| CVE-2023-0482In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that…Redhat · RESTEasy · CVSS 5.5 · 2023-02-17 | 5.5 | 0.3% | 2023-02-17 |
| CVE-2021-1429Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco · Cisco AnyConnect Secure Mobility Client · CVSS 7 · 2021-05-06 | 7.0 | 0.2% | 2021-05-06 |
| CVE-2021-1428Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco · Cisco AnyConnect Secure Mobility Client · CVSS 7 · 2021-05-06 | 7.0 | 0.2% | 2021-05-06 |
| CVE-2021-1427Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco · Cisco AnyConnect Secure Mobility Client · CVSS 7 · 2021-05-06 | 7.0 | 0.2% | 2021-05-06 |
| CVE-2021-1426Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco · Cisco AnyConnect Secure Mobility Client · CVSS 7 · 2021-05-06 | 7.0 | 0.2% | 2021-05-06 |
| CVE-2022-24411Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE could potentially exp…Dell · PowerScale OneFS · CVSS 7.8 · 2022-04-12 | 7.8 | 0.2% | 2022-04-12 |
| CVE-2025-27148Gradle vulnerable to local privilege escalation through system temporary directorygradle · gradle · CVSS 8.8 · 2025-02-25 | 8.8 | 0.2% | 2025-02-25 |
| CVE-2025-55629Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allow attackers to arbitrarily change other users' passwords vi…No vendor recorded · CVSS 6.5 · 2025-08-22 | 6.5 | 0.2% | 2025-08-22 |
| CVE-2021-1430Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco · Cisco AnyConnect Secure Mobility Client · CVSS 7 · 2021-05-06 | 7.0 | 0.2% | 2021-05-06 |
| CVE-2023-28600Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss…Zoom Video Communications, Inc. · Zoom for macOS Client · CVSS 5.2 · 2023-06-13 | 5.2 | 0.2% | 2023-06-13 |
| CVE-2024-42052The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate pr…Splashtop · Streamer · CVSS 7.8 · 2024-07-28 | 7.8 | 0.2% | 2024-07-28 |
| CVE-2026-126627Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local usersApache Software Foundation · Apache XML Graphics FOP · 2026-11-11 | – | 0.2% | 2026-11-11 |
| CVE-2023-0481In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that coul…Quarkus · Quarkus · CVSS 3.3 · 2023-02-24 | 3.3 | 0.2% | 2023-02-24 |
| CVE-2025-34352JumpCloud Remote Assist < 0.317.0 Arbitrary File Write/Delete via Insecure Temp DirectoryJumpCloud Inc. · Remote Assist · CVSS 8.5 · 2025-12-02 | 8.5 | 0.2% | 2025-12-02 |
| CVE-2026-4137Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflowmlflow · mlflow/mlflow · CVSS 7 · 2026-05-18 | 7.0 | 0.2% | 2026-05-18 |
| CVE-2025-32438Local privilege escalation in make-initrd-ngNixOS · nixpkgs · CVSS 8.8 · 2025-04-15 | 8.8 | 0.2% | 2025-04-15 |
| CVE-2024-47884Insecure Temporary File in `foxmarks`zefr0x · foxmarks · CVSS 2.4 · 2024-10-11 | 2.4 | 0.2% | 2024-10-11 |
| CVE-2023-26603JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions. This allows privilege escalation to SYSTEM via a repair action in the installer.No vendor recorded · CVSS 5.9 · 2024-04-26 | 5.9 | 0.2% | 2024-04-26 |
| CVE-2024-52543Dell NativeEdge, version(s) 2.1.0.0, contain(s) a Creation of Temporary File With Insecure Permissions vulnerability. A high privileged attacker with local access could potentiall…Dell · NativeEdge · CVSS 6.5 · 2024-12-25 | 6.5 | 0.2% | 2024-12-25 |
| CVE-2026-4822Enter Software Iperius Backup Backup Service temp fileEnter Software · Iperius Backup · CVSS 7 · 2026-03-25 | 7.0 | 0.2% | 2026-03-25 |
| CVE-2023-27408A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The `i2c` mutex file is created with the permissions bits of `-rw-rw-rw-`. This file is used as a mu…Siemens · SCALANCE LPE9403 · CVSS 3.3 · 2023-05-09 | 3.3 | 0.2% | 2023-05-09 |
| CVE-2025-38747Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could pote…Dell · SupportAssist OS Recovery · CVSS 7.8 · 2025-08-06 | 7.8 | 0.2% | 2025-08-06 |
| CVE-2025-7647Insecure Temporary File Handling in run-llama/llama_indexrun-llama · run-llama/llama_index · CVSS 7.3 · 2025-09-27 | 7.3 | 0.1% | 2025-09-27 |
| CVE-2025-9474Mihomo Party Socket sysproxy.ts enableSysProxy temp fileMihomo · Party · CVSS 4.5 · 2025-08-26 | 4.5 | 0.1% | 2025-08-26 |
| CVE-2026-97025Flatpak: flatpak: world-readable oci authentication token in system-helper cache pathRed Hat · Red Hat Enterprise Linux 10 · CVSS 3.2 · 2026-09-28 | 3.2 | 0.1% | 2026-09-28 |
| CVE-2026-33572OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript FilesOpenClaw · OpenClaw · CVSS 8.4 · 2026-03-29 | 8.4 | 0.1% | 2026-03-29 |
| CVE-2025-46684Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged attacker with local acce…Dell · SupportAssist OS Recovery, · CVSS 6.6 · 2026-01-13 | 6.6 | 0.1% | 2026-01-13 |
| CVE-2025-46685Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged attacker with local acce…Dell · SupportAssist OS Recovery · CVSS 7.5 · 2026-01-13 | 7.5 | 0.1% | 2026-01-13 |
| CVE-2026-97026Flatpak: flatpak: world-writable temporary child repositories in system-helper cache pathRed Hat · Red Hat Enterprise Linux 10 · CVSS 3.9 · 2026-09-28 | 3.9 | 0.1% | 2026-09-28 |
| CVE-2026-25265Creation of Temporary File with Insecure Permissions in Qualcomm Software CenterQualcomm, Inc. · Snapdragon · CVSS 8.8 · 2026-09-22 | 8.8 | 0.1% | 2026-09-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.