Skip to content
OpenAdvisories

Weakness (CWE)

CWE-379: Creation of Temporary File in Directory with Insecure Permissions

Base Incomplete

The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

How to prevent it (3 mitigations)

  1. Requirements

    Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.

  2. Implementation

    Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.

  3. Implementation

    Avoid using vulnerable temp file functions.

Source: MITRE CWE-379

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-118131

    CVE-2026-118131

    GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An att…

    gnupg GnuPG gnupg2 gnupg2 Ubuntu Azure Linux
  • Critical 9.3
    CVE-2021-21428

    Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator

    Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createT…

    OpenAPITools openapi-generator org.openapitools:openapi-generator-online Maven