# CWE-377.

Every Advisory and CVE whose sources give the weakness CWE-377, newest first.

## Records, newest first

- [Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill](https://agentprime.io/advisories/CVE-2026-104657.md)
  `CVE-2026-104657` · CVE record: Progress Software Fiddler Download & Setup Skill · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2026 · Tags: CWE-377, CWE-494
- [Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer](https://agentprime.io/advisories/CVE-2026-122137.md)
  `CVE-2026-122137` · CVE record: romkatv powerlevel10k and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-377
- [nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins](https://agentprime.io/advisories/CVE-2026-121549.md)
  `CVE-2026-121549` · CVE record: jarun nnn · CVSS 4.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-377
- [Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build](https://agentprime.io/advisories/CVE-2026-97209.md)
  `CVE-2026-97209` · CVE record: elixir-lang elixir · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-377
- [Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root](https://agentprime.io/advisories/CVE-2026-93864.md)
  `CVE-2026-93864` · CVE record: WatchGuard Fireware OS · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal, CWE-377
- [virtualenv: Temporary app-data can leave dangling seed package links](https://agentprime.io/advisories/GHSA-4f8h-vr72-p32c.md)
  `GHSA-4f8h-vr72-p32c`, `BIT-virtualenv-2026-113713`, `CVE-2026-113713` · PyPI `virtualenv`: affected `>=21.14.8, <21.14.10`, fixed in `21.14.10` · CVSS 4.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-377
- [Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76497.md)
  `CVE-2026-76497` · CVE record: Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 6.6 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-377
- [Terragrunt catalog predictable temp symlink clobber](https://agentprime.io/advisories/GHSA-wv6g-x823-wx9m.md)
  `GHSA-wv6g-x823-wx9m`, `CVE-2026-64672`, `GO-2026-6768` · Go `github.com/gruntwork-io/terragrunt`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 4.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, CWE-377
- [CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)](https://agentprime.io/advisories/CVE-2026-55480.md)
  `CVE-2026-55480` · CVE record: OpenPrinting cups · CVSS 5.7 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, CWE-377
- [Metalama allows local code execution through DLL planting in shared temporary directories](https://agentprime.io/advisories/GHSA-m6wq-39m7-9xpp.md)
  `GHSA-m6wq-39m7-9xpp`, `CVE-2026-62847` · NuGet `Metalama.Framework` and 1 more: affected `<2025.1.18 || >=2026.0.0-preview, <2026.0.25 || >=2026.1.0-preview, <2026.1.19`, fixed in `2025.1.18`, `2026.0.25`, `2026.1.19` · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-377, CWE-427
- [Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server](https://agentprime.io/advisories/CVE-2026-82715.md)
  `CVE-2026-82715` · CVE record: Hitachi Hitachi Disk Array Driver for AIX and 1 more · CVSS 7.9 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-377
- [Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture](https://agentprime.io/advisories/CVE-2026-110234.md)
  `CVE-2026-110234` · CVE record: elio-fm elio · CVSS 4.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-377
- [Code for IBM i: Temporary files are visible to all users](https://agentprime.io/advisories/CVE-2026-49484.md)
  `CVE-2026-49484` · CVE record: codefori vscode-ibmi · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-377, CWE-459
- [yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user](https://agentprime.io/advisories/GHSA-mcr4-qmvw-px4g.md)
  `GHSA-mcr4-qmvw-px4g`, `CVE-2026-106451` · Maven `at.yawk.lz4:lz4-java` and 1 more: affected `<1.11.4`, fixed in `1.11.4` · CVSS 7.3 High · Not analysed yet · Published 7 Oct 2026 · Tags: Race condition, CWE-377
- [Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability](https://agentprime.io/advisories/CVE-2026-79899.md)
  `CVE-2026-79899` · CVE record: Fortra BoKS Manager · CVSS 7.9 High · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-377
- [mport trusts environment-controlled temporary directories in privileged metadata extraction](https://agentprime.io/advisories/CVE-2026-54584.md)
  `CVE-2026-54584` · CVE record: MidnightBSD mport · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Path traversal, CWE-377
- [Insecure temporary file in Dell PowerScale OneFS](https://agentprime.io/advisories/CVE-2026-40635.md)
  `CVE-2026-40635` · CVE record: Dell PowerScale OneFS · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-377
- [Predictable cache directory location allows local ONNX model substitution in Spring AI](https://agentprime.io/advisories/CVE-2026-47852.md)
  `CVE-2026-47852` · CVE record: Spring Spring AI · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-377
- [Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)](https://agentprime.io/advisories/CVE-2026-63404.md)
  `CVE-2026-63404` · CVE record: contribsys faktory · CVSS 7.3 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-377
- [Weak File Name Generation in vsDesk](https://agentprime.io/advisories/CVE-2025-14602.md)
  `CVE-2025-14602` · CVE record: vsDesk vsDesk · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-340, CWE-377
- [phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP](https://agentprime.io/advisories/CVE-2026-75920.md)
  `CVE-2026-75920` · CVE record: thorsten phpMyFAQ · CVSS 6.0 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-377
- [ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite](https://agentprime.io/advisories/GHSA-2jwf-f4xq-f24h.md)
  `GHSA-2jwf-f4xq-f24h`, `CVE-2026-55086` · npm `ep_etherpad-lite`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 4.2 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, CWE-377
- [Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling](https://agentprime.io/advisories/CVE-2026-73584.md)
  `CVE-2026-73584` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-377
- [Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack](https://agentprime.io/advisories/CVE-2026-73585.md)
  `CVE-2026-73585` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-377
- [Predictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLI](https://agentprime.io/advisories/CVE-2026-16791.md)
  `CVE-2026-16791` · CVE record: Lenovo XClarity Essentials OneCLI · CVSS 1.0 Low · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-377
- [Authenticated Path Traversal allows Unauthorized Access in Web Interface](https://agentprime.io/advisories/CVE-2026-44878.md)
  `CVE-2026-44878` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateway (ECOS) · CVSS 7.2 High · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, CWE-377
- [Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"](https://agentprime.io/advisories/CVE-2026-62294.md)
  `CVE-2026-62294` · CVE record: flameshot-org flameshot · CVSS 5.1 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Race condition, CWE-377
- [Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases](https://agentprime.io/advisories/GHSA-r35r-fpx2-jgr4.md)
  `GHSA-r35r-fpx2-jgr4`, `CVE-2026-53759`, `PYSEC-2026-2596` · PyPI `linuxfabrik-lib`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 2.0 Low · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-377
- [mktemp: empty TMPDIR creates temp files in CWD instead of /tmp](https://agentprime.io/advisories/GHSA-2w8r-9xj7-69j5.md)
  `GHSA-2w8r-9xj7-69j5`, `CVE-2026-35342` · crates.io `uu_mktemp`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 3.3 Low · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-377
- [Predictable Temporary File in GNU gzip](https://agentprime.io/advisories/CVE-2026-41991.md)
  `CVE-2026-41991` · CVE record: GNU gzip · CVSS 2.0 Low · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-377
- [@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write](https://agentprime.io/advisories/GHSA-4vp2-6q8c-pvq2.md)
  `GHSA-4vp2-6q8c-pvq2`, `CVE-2026-46406` · npm `@anthropic-ai/claude-code`: affected `>=2.1.59, <2.1.128`, fixed in `2.1.128` · CVSS 4.4 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Path traversal, Information disclosure, CWE-377
- [Spring Boot: Predictable Temp Directory in Artemis Auto-configuration](https://agentprime.io/advisories/GHSA-ggg2-9786-hwc8.md)
  `GHSA-ggg2-9786-hwc8`, `CVE-2026-41001` · Maven `org.springframework.boot:spring-boot-autoconfigure`: affected `>=4.0.0, <4.0.7 || >=3.5.0, <3.5.15 || >=3.4.0, <=3.4.16 || >=3.3.0, <=3.3.19 || >=2.7.0, <=2.7.33`, fixed in `4.0.7`, `3.5.15` · CVSS 5.3 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-377
- [bit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive Update](https://agentprime.io/advisories/CVE-2026-45384.md)
  `CVE-2026-45384` · CVE record: rikyoz bit7z · CVSS 6.1 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Path traversal, CWE-377
- [CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow](https://agentprime.io/advisories/CVE-2026-49135.md)
  `CVE-2026-49135` · CVE record: steipete CodexBar · CVSS 7.2 High · Not analysed yet · Published 1 Jun 2026 · Tags: Path traversal, CWE-377
- [CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp File](https://agentprime.io/advisories/CVE-2026-49134.md)
  `CVE-2026-49134` · CVE record: steipete CodexBar · CVSS 7.5 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-377
- [Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory](https://agentprime.io/advisories/GHSA-r5hp-3cgj-j6xv.md)
  `GHSA-r5hp-3cgj-j6xv`, `CVE-2026-40979` · Maven `org.springframework.ai:spring-ai-transformers`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5`, fixed in `1.0.6`, `1.1.5` · CVSS 6.1 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-377
- [Spring Boot accepts predictable temp directory without ownership verification](https://agentprime.io/advisories/GHSA-wwpq-f5c3-7hvx.md)
  `GHSA-wwpq-f5c3-7hvx`, `CVE-2026-40973` · Maven `org.springframework.boot:spring-boot`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32`, fixed in `4.0.6`, `3.5.14` · CVSS 7.0 High · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-377
- [The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthen…](https://agentprime.io/advisories/CVE-2025-67223.md)
  `CVE-2025-67223` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Apr 2026 · Tags: Information disclosure, CWE-377
- [Duplicate Advisory: uutils coreutils' mktemp utility doesn't properly handle an empty TMPDIR environment variable](https://agentprime.io/advisories/GHSA-2cxp-xq3c-mjxx.md)
  `GHSA-2cxp-xq3c-mjxx` · crates.io `coreutils`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 3.3 Low · Withdrawn · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-377
- [Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-20204.md)
  `CVE-2026-20204` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.1 High · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-377
- [poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645](https://agentprime.io/advisories/GHSA-5qvp-pr9f-2g2v.md)
  `GHSA-5qvp-pr9f-2g2v` · PyPI `poetry-plugin-tweak-dependencies-version`: affected `<1.5.6`, fixed in `1.5.6` · CVSS 4.4 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-377
- [Enter Software Iperius Backup Backup Service temp file](https://agentprime.io/advisories/CVE-2026-4822.md)
  `CVE-2026-4822` · CVE record: Enter Software Iperius Backup · CVSS 7.3 High · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-377, CWE-378
- [Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function](https://agentprime.io/advisories/GHSA-gc5v-m9x4-r6x2.md)
  `GHSA-gc5v-m9x4-r6x2`, `CVE-2026-25645`, `PYSEC-2026-2275` · PyPI `requests`: affected `<2.33.0`, fixed in `2.33.0` · CVSS 4.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-377
- [Insecure temporary file in Apple macOS](https://agentprime.io/advisories/CVE-2026-20651.md)
  `CVE-2026-20651` · CVE record: Apple macOS · CVSS 6.2 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-377
- [Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)](https://agentprime.io/advisories/GHSA-8mpm-q7mh-8fvh.md)
  `GHSA-8mpm-q7mh-8fvh`, `CVE-2026-56236` · npm `@capgo/cli`: affected `<7.84.6`, fixed in `7.84.6` · CVSS 6.8 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Path traversal, Broken access control, CWE-377
- [Insecure temporary file in openSUSE sdbootutil](https://agentprime.io/advisories/CVE-2026-25701.md)
  `CVE-2026-25701` · CVE record: openSUSE sdbootutil · CVSS 7.0 High · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-377
- [Insecure temporary file in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-20649.md)
  `CVE-2026-20649` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-377
- [Insecure temporary file in Apple macOS](https://agentprime.io/advisories/CVE-2026-20618.md)
  `CVE-2026-20618` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-377
- [Quartus® Prime Standard and Quartus® Prime Lite Security Advisory](https://agentprime.io/advisories/CVE-2025-14614.md)
  `CVE-2025-14614` · CVE record: Altera Quartus Prime Standard and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-377
- [Quartus Prime Pro Edition Advisory](https://agentprime.io/advisories/CVE-2025-14612.md)
  `CVE-2025-14612` · CVE record: Altera Quartus Prime Pro · CVSS 5.4 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-377
- [Robocode has an insecure temporary file creation vulnerability in the AutoExtract component](https://agentprime.io/advisories/GHSA-2mxr-rc97-xrj2.md)
  `GHSA-2mxr-rc97-xrj2`, `CVE-2025-14307` · Maven `net.sf.robocode:robocode.battle`: affected `<1.9.5.6`, fixed in `1.9.5.6` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-377
- [Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality](https://agentprime.io/advisories/GHSA-hfv2-pf68-m33x.md)
  `GHSA-hfv2-pf68-m33x`, `CVE-2025-66625` · NuGet `Umbraco.Cms`: affected `>=10.0.0, <13.12.1`, fixed in `13.12.1` · CVSS 4.9 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Information disclosure, CWE-377
- [Insecure temporary file in Dell Alienware Command Center 6.x (AWCC)](https://agentprime.io/advisories/CVE-2025-46369.md)
  `CVE-2025-46369` · CVE record: Dell Alienware Command Center 6.x (AWCC) · CVSS 7.8 High · Not analysed yet · Published 13 Nov 2025 · Tags: CWE-377
- [Insecure temporary file in Dell Alienware Command Center 6.x (AWCC)](https://agentprime.io/advisories/CVE-2025-46368.md)
  `CVE-2025-46368` · CVE record: Dell Alienware Command Center 6.x (AWCC) · CVSS 6.6 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: CWE-377
- [llama-index has Insecure Temporary File](https://agentprime.io/advisories/GHSA-rg9h-vx28-xxp5.md)
  `GHSA-rg9h-vx28-xxp5`, `CVE-2025-7707`, `PYSEC-2026-1556` · PyPI `llama-index`: affected `<0.13.0`, fixed in `0.13.0` · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2025 · Tags: CWE-377
- [Insecure temporary file in magicmonty bash-git-prompt](https://agentprime.io/advisories/CVE-2025-61659.md)
  `CVE-2025-61659` · CVE record: magicmonty bash-git-prompt · CVSS 6.8 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: CWE-377
- [Vasion Print (formerly PrinterLogic) Local Privilege Escalation via Insecure Temporary File Handling](https://agentprime.io/advisories/CVE-2025-34194.md)
  `CVE-2025-34194` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 8.5 High · Not analysed yet · Published 19 Sept 2025 · Tags: Path traversal, CWE-377
- [Mihomo Party Socket sysproxy.ts enableSysProxy temp file](https://agentprime.io/advisories/CVE-2025-9474.md)
  `CVE-2025-9474` · CVE record: Mihomo Party · CVSS 2.0 Low · Not analysed yet · Published 26 Aug 2025 · Tags: CWE-377, CWE-378
- [Insecure temporary file in pycode-browser](https://agentprime.io/advisories/CVE-2015-0849.md)
  `CVE-2015-0849` · CVE record: pycode-browser pycode-browser · CVSS 3.9 Low · Not analysed yet · Published 26 Jun 2025 · Tags: CWE-377
- [Insecure Temporary File usage in github.com/golang/glog](https://agentprime.io/advisories/GHSA-6wxm-mpqj-6jpf.md)
  `GHSA-6wxm-mpqj-6jpf`, `CVE-2024-45339`, `GO-2025-3372` · Go `github.com/golang/glog`: affected `<1.2.4`, fixed in `1.2.4` · CVSS 7.1 High · Not analysed yet · Published 28 Jan 2025 · Tags: CWE-61, CWE-377

Older: <https://agentprime.io/advisories/tag/cwe-377.md?cursor=WyIyMDI1LTAxLTI4VDE3OjI5OjAzLjAwMDAwMFoiLCJHSFNBLTZ3eG0tbXBxai02anBmIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-377>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-377/>. Everything for agents: <https://agentprime.io/llms.txt>.