CWE-377: Insecure Temporary File
Class
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
Consequences
- Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories
Recent advisories
- GHSA-4vp2-6q8c-pvq2 — @anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write
- GHSA-gc5v-m9x4-r6x2 — Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
- GHSA-hfv2-pf68-m33x — Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
- GHSA-hq87-h4jg-vxfw — Jenkins temporary uploaded file created with insecure permissions
- GHSA-cr5q-6q9f-rq6q — Active Support Possibly Discloses Locally Encrypted Files
- GHSA-282v-666c-3fvg — transformers has Insecure Temporary File
- GHSA-9645-6g72-2pv8 — phpMyAdmin unsafely handles temporary files
- GHSA-c4mc-49hq-q275 — Puppet uses predictable filenames, allowing arbitrary file overwrite
- GHSA-6xp6-fmc8-pmmr — Temporary Directory Hijacking Vulnerability in Keycloak
- GHSA-vqj2-4v8m-8vrq — Insecure Temporary File in mlflow
- GHSA-vp9j-rghq-8jhh — Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
- GHSA-77g3-3j5w-64w4 — Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
- GHSA-vcg8-98q8-g7mj — Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible
- GHSA-g4mq-6fp5-qwcf — Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File
- GHSA-9qj7-jvg4-qr2x — Phusion Passenger Denial of Service
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor