CWE-378: Creation of Temporary File With Insecure Permissions
BaseLikelihood of exploit: High
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
Consequences
- Confidentiality: Read Application Data
- Authorization, Other: Other
- Integrity, Other: Other
How to prevent it
- Requirements: Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
- Implementation: Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.
- Implementation: Randomize temporary file names. This can also be achieved by using a safe temp-file function. This will ensure that temporary files will not be created in predictable places.
Recent advisories
- GHSA-f2m9-wcf4-cwwx — MLFlow Creates a Temporary File With Insecure Permissions
- GHSA-vr7j-g7jv-h5mp — OpenClaw session transcript files were created without forced user-only permissions
- GHSA-269q-hmxg-m83q — Local Information Disclosure Vulnerability in io.netty:netty-codec-http
- GHSA-5mcr-gq6c-3hq2 — Local Information Disclosure Vulnerability in Netty on Unix-Like systems
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor