Weaknesses of type CWE-377

108 results

Arquivo Temporário Inseguro

A aplicação cria arquivos temporários com nomes previsíveis ou em locais acessíveis, permitindo que um atacante local adivinhe, substitua ou acesse dados sensíveis antes de serem deletados. O risco é amplificado em ambientes multi-usuário onde qualquer pessoa pode ler ou sobrescrever esses arquivos.

Example

Um script Java que gera relatório usando `File temp = new File("/tmp/relatorio_" + userId + ".txt")` é vulnerável: outro usuário do sistema pode prever o nome, criar um link simbólico apontando para `/etc/passwd`, e quando a aplicação tentar escrever, compromete um arquivo crítico.

How to mitigate

Use APIs seguras da plataforma: `Files.createTempFile()` em Java, `tempfile.mkstemp()` em Python, ou `mktemp -d` em shell. Garantir permissões restritivas (0600 no Unix) e sempre deletar após uso. Evitar nomes previsíveis e nunca usar `/tmp` sem validação em contextos críticos.

CVE-2024-2313LOWIf kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use thEPSS 0.2%CVE-2024-34490MEDIUMIn Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controllEPSS 0.2%CVE-2026-55086MEDIUMEtherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwriteEPSS 0.2%CVE-2026-4822HIGHEnter Software Iperius Backup Backup Service temp fileEPSS 0.2%CVE-2026-46406MEDIUMClaude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File WriteEPSS 0.2%CVE-2022-34387MEDIUM Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilEPSS 0.2%CVE-2026-63404HIGHFaktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)EPSS 0.2%CVE-2025-61659MEDIUMbash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.EPSS 0.1%CVE-2026-62294MEDIUMFlameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"EPSS 0.1%CVE-2025-9474LOWMihomo Party Socket sysproxy.ts enableSysProxy temp fileEPSS 0.1%CVE-2026-40973HIGHA local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.seEPSS 0.1%CVE-2026-20618MEDIUMAn issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access userEPSS 0.1%CVE-2021-22572MEDIUMData-transfer-project information disclosure via tmp directoryEPSS 0.1%CVE-2026-35342LOWuutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIREPSS 0.1%CVE-2026-49135HIGHCodexBar < 0.32.0 Insecure Temporary File Handling in Notarization WorkflowEPSS 0.1%CVE-2026-45384MEDIUMbit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive UpdateEPSS 0.1%CVE-2025-46369HIGHDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aEPSS 0.1%CVE-2015-0849LOWpycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.EPSS 0.1%CVE-2025-46368MEDIUMDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aEPSS 0.1%CVE-2026-25701HIGHAn Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects likeEPSS 0.1%