Weaknesses of type CWE-377

124 results

Arquivo Temporário Inseguro

A aplicação cria arquivos temporários com nomes previsíveis ou em locais acessíveis, permitindo que um atacante local adivinhe, substitua ou acesse dados sensíveis antes de serem deletados. O risco é amplificado em ambientes multi-usuário onde qualquer pessoa pode ler ou sobrescrever esses arquivos.

Example

Um script Java que gera relatório usando `File temp = new File("/tmp/relatorio_" + userId + ".txt")` é vulnerável: outro usuário do sistema pode prever o nome, criar um link simbólico apontando para `/etc/passwd`, e quando a aplicação tentar escrever, compromete um arquivo crítico.

How to mitigate

Use APIs seguras da plataforma: `Files.createTempFile()` em Java, `tempfile.mkstemp()` em Python, ou `mktemp -d` em shell. Garantir permissões restritivas (0600 no Unix) e sempre deletar após uso. Evitar nomes previsíveis e nunca usar `/tmp` sem validação em contextos críticos.

CVE-2026-53759LOWlinuxfabrik-lib: Insecure creation of SQLite databasesEPSS 0.2%CVE-2025-7707HIGHWorld-Writable NLTK Cache Directory Vulnerability in run-llama/llama_indexEPSS 0.2%CVE-2026-25645MEDIUMRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionEPSS 0.2%CVE-2024-2313LOWIf kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use thEPSS 0.2%CVE-2024-34490MEDIUMIn Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controllEPSS 0.2%CVE-2026-64672MEDIUMTerragrunt catalog predictable temp symlink clobberEPSS 0.2%CVE-2026-4822HIGHEnter Software Iperius Backup Backup Service temp fileEPSS 0.2%CVE-2026-63404HIGHFaktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)EPSS 0.2%CVE-2026-76497MEDIUMCisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File VulnerabilitiesEPSS 0.2%CVE-2026-46406MEDIUMClaude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File WriteEPSS 0.2%CVE-2022-34387MEDIUM Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilEPSS 0.2%CVE-2026-62847HIGHMetalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)EPSS 0.2%CVE-2026-20618MEDIUMAn issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access userEPSS 0.1%CVE-2025-9474LOWMihomo Party Socket sysproxy.ts enableSysProxy temp fileEPSS 0.1%CVE-2026-73585MEDIUMSblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attackEPSS 0.1%CVE-2025-61659MEDIUMbash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.EPSS 0.1%CVE-2026-62294MEDIUMFlameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"EPSS 0.1%CVE-2026-55086MEDIUMEtherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwriteEPSS 0.1%CVE-2026-110234MEDIUMElio through 1.13.0 Insecure Temporary File Creation in External Preview Command CaptureEPSS 0.1%CVE-2026-40973HIGHA local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.seEPSS 0.1%