Weaknesses of type CWE-377

108 results

Arquivo Temporário Inseguro

A aplicação cria arquivos temporários com nomes previsíveis ou em locais acessíveis, permitindo que um atacante local adivinhe, substitua ou acesse dados sensíveis antes de serem deletados. O risco é amplificado em ambientes multi-usuário onde qualquer pessoa pode ler ou sobrescrever esses arquivos.

Example

Um script Java que gera relatório usando `File temp = new File("/tmp/relatorio_" + userId + ".txt")` é vulnerável: outro usuário do sistema pode prever o nome, criar um link simbólico apontando para `/etc/passwd`, e quando a aplicação tentar escrever, compromete um arquivo crítico.

How to mitigate

Use APIs seguras da plataforma: `Files.createTempFile()` em Java, `tempfile.mkstemp()` em Python, ou `mktemp -d` em shell. Garantir permissões restritivas (0600 no Unix) e sempre deletar após uso. Evitar nomes previsíveis e nunca usar `/tmp` sem validação em contextos críticos.

CVE-2026-75920MEDIUMphpMyFAQ before 4.1.6 Information Disclosure via Backup ZIPEPSS 0.3%CVE-2025-14307CRITICALInsecure Temporary File Creation in Robocode's AutoExtract ComponentEPSS 0.3%CVE-2021-25316LOWLocal DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-toolsEPSS 0.3%CVE-2023-49342MEDIUMTemporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The dataEPSS 0.3%CVE-2020-25636MEDIUMA flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are EPSS 0.3%CVE-2018-17955LOWStatic tempfile name allows overwriting of arbitrary filesEPSS 0.3%CVE-2025-34194HIGHVasion Print (formerly PrinterLogic) Local Privilege Escalation via Insecure Temporary File HandlingEPSS 0.3%CVE-2020-8027HIGHopenldap uses fixed paths in /tmpEPSS 0.3%CVE-2023-49347MEDIUMTemporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data EPSS 0.3%CVE-2023-49346MEDIUMTemporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The datEPSS 0.3%CVE-2023-49344MEDIUMTemporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. TheEPSS 0.3%CVE-2023-49345MEDIUMTemporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The dataEPSS 0.3%CVE-2018-19640MEDIUMCode execution if run with command line switch -vEPSS 0.3%CVE-2021-20202—A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider EPSS 0.3%CVE-2023-2800MEDIUMInsecure Temporary File in huggingface/transformersEPSS 0.3%CVE-2024-10372LOWchidiwilliams buzz model_loader.py download_model temp fileEPSS 0.3%CVE-2020-1991HIGHTraps: Insecure temporary file vulnerability may allow privilege escalation on WindowsEPSS 0.3%CVE-2025-14602MEDIUMWeak File Name Generation in vsDeskEPSS 0.3%CVE-2026-49134HIGHCodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp FileEPSS 0.3%CVE-2026-54584MEDIUMmport trusts environment-controlled temporary directories in privileged metadata extractionEPSS 0.3%