Falhas do tipo CWE-377

108 resultados

Arquivo temporário inseguro

A aplicação cria arquivos temporários de forma previsível ou sem proteção adequada de permissões, permitindo que um atacante leia, modifique ou substitua o arquivo antes que a aplicação o use. Isso pode expor dados sensíveis ou levar a execução de código malicioso.

Exemplo

Um programa de backup cria um arquivo temporário com nome fixo como `/tmp/backup_dados.tmp` ou `/tmp/app123.tmp` sem definir permissões restritivas. Um atacante em sistema compartilhado cria um link simbólico apontando para um arquivo crítico, fazendo a aplicação sobrescrever permissões ou dados importantes.

Como mitigar

Use APIs seguras para criar arquivos temporários (como `mkstemp()` em C, `tempfile` em Python ou `Files.createTempFile()` em Java) que geram nomes aleatórios e definem permissões restritas automaticamente. Evite caminhos fixos e prefixos previsíveis, e sempre valide se o arquivo foi criado apenas pela aplicação.

CVE-2026-75920MEDIUMphpMyFAQ before 4.1.6 Information Disclosure via Backup ZIPEPSS 0.3%CVE-2025-14307CRITICALInsecure Temporary File Creation in Robocode's AutoExtract ComponentEPSS 0.3%CVE-2021-25316LOWLocal DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-toolsEPSS 0.3%CVE-2023-49342MEDIUMTemporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The dataEPSS 0.3%CVE-2020-25636MEDIUMA flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are EPSS 0.3%CVE-2018-17955LOWStatic tempfile name allows overwriting of arbitrary filesEPSS 0.3%CVE-2025-34194HIGHVasion Print (formerly PrinterLogic) Local Privilege Escalation via Insecure Temporary File HandlingEPSS 0.3%CVE-2020-8027HIGHopenldap uses fixed paths in /tmpEPSS 0.3%CVE-2023-49347MEDIUMTemporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data EPSS 0.3%CVE-2023-49346MEDIUMTemporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The datEPSS 0.3%CVE-2023-49344MEDIUMTemporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. TheEPSS 0.3%CVE-2023-49345MEDIUMTemporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The dataEPSS 0.3%CVE-2018-19640MEDIUMCode execution if run with command line switch -vEPSS 0.3%CVE-2021-20202—A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider EPSS 0.3%CVE-2023-2800MEDIUMInsecure Temporary File in huggingface/transformersEPSS 0.3%CVE-2024-10372LOWchidiwilliams buzz model_loader.py download_model temp fileEPSS 0.3%CVE-2020-1991HIGHTraps: Insecure temporary file vulnerability may allow privilege escalation on WindowsEPSS 0.3%CVE-2025-14602MEDIUMWeak File Name Generation in vsDeskEPSS 0.3%CVE-2026-49134HIGHCodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp FileEPSS 0.3%CVE-2026-54584MEDIUMmport trusts environment-controlled temporary directories in privileged metadata extractionEPSS 0.3%