Advisories · Weakness
CWE-378.
Every Advisory and CVE whose sources give the weakness CWE-378, newest first.
- CVSS 3.9 Low
Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- CWE-378
- CVSS 3.2 Low
Flatpak: flatpak: world-readable oci authentication token in system-helper cache path
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- CWE-378
- CVSS 8.8 High
Creation of Temporary File with Insecure Permissions in Qualcomm Software Center
- Qualcomm, Inc. Snapdragon
- CWE-378
- CVSS 4.4 Medium
osquery: Unprivileged users can temporarily read file carve contents
- osquery
- CWE-279
- CWE-378
- CVSS 7.0 High
MLFlow Creates a Temporary File With Insecure Permissions
- CWE-378
>=1.26.0, <3.11.0 · fixed in 3.11.0
GHSA-f2m9-wcf4-cwwx · CVE-2026-4137 - CVSS 8.4 High
Duplicate Advisory: OpenClaw session transcript files were created without forced user-only permissions
- CWE-378
<2026.2.17 · fixed in 2026.2.17
GHSA-9q8j-chc7-wpgp - CVSS 7.3 High
Enter Software Iperius Backup Backup Service temp file
- Enter Software Iperius Backup
- CWE-377
- CWE-378
- CVSS 6.8 Medium
OpenClaw session transcript files were created without forced user-only permissions
- Broken access control
- CWE-378
<2026.2.17 · fixed in 2026.2.17
GHSA-vr7j-g7jv-h5mp · CVE-2026-33572 - CVSS 4.8 Medium
Spring Data Geode Insecure Temporary Directory Usage
- VMware Spring Data Geode
- VMware Spring Data Gemfire
- Information disclosure
- CWE-378
- CVSS 7.5 High
Dell SupportAssist OS Recovery: Dell SupportAssist OS Recovery, versions prior to 5.5.15.1…
- Dell SupportAssist OS Recovery
- CWE-378
- CVSS 6.6 Medium
Dell SupportAssist OS Recovery,: Dell SupportAssist OS Recovery, versions prior to 5.5.15.1…
- Dell SupportAssist OS Recovery,
- CWE-378
- CVSS 8.5 High
JumpCloud Remote Assist < 0.317.0 Arbitrary File Write/Delete via Insecure Temp Directory
- JumpCloud Inc. Remote Assist
- Path traversal
- CWE-378
- CVSS 7.3 High
llama-index-core insecurely handles temporary files
- CWE-378
<0.13.0 · fixed in 0.13.0
GHSA-cr7q-2w66-hjcm · CVE-2025-7647 - CVSS 7.4 High
Podman Creates Temporary File with Insecure Permissions
- CWE-378
<=5.5.0 · no fixed version yet
GHSA-m68q-4hqr-mc6f · CVE-2025-4953 - CVSS 2.0 Low
Mihomo Party Socket sysproxy.ts enableSysProxy temp file
- Mihomo Party
- CWE-377
- CWE-378
- CVSS 6.5 Medium
Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allow attackers to arbitrarily change other users' passwords via manipulation of th…
- CWE-378
- CVSS 7.8 High
Dell SupportAssist OS Recovery: Dell SupportAssist OS Recovery, versions prior to 5.5.14.0…
- Dell SupportAssist OS Recovery
- CWE-378
- CVSS 6.5 Medium
NETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users.
- CWE-378
- CVSS 8.8 High
Local privilege escalation in make-initrd-ng
- NixOS nixpkgs
- CWE-378
- CWE-379
- CVSS 8.8 High
Gradle vulnerable to local privilege escalation through system temporary directory
- gradle
- CWE-378
- CWE-379
- CVSS 5.5 Medium
Insecure Temporary File in RESTEasy
- CWE-378
>=6.0.0.Beta1, <6.2.3.Final || >=5.0.0.Alpha1, <5.0.6.Final || >=4.0.0.Beta1, <4.7.8.Final || <3.15.5.Final · fixed in 6.2.3.Final, 5.0.6.Final, 4.7.8.Final, 3.15.5.Final
GHSA-2c6g-pfx3-w7h8 · CVE-2023-0482 - CVSS 6.5 Medium
Dell NativeEdge: Dell NativeEdge, version(s) 2.1.0.0, contain(s) a Creation of Temporary File With…
- Dell NativeEdge
- CWE-378
- CVSS 2.4 Low
Insecure Temporary File in `foxmarks`
- zefr0x foxmarks
- CWE-378
- CVSS 3.3 Low
Apache Hadoop: Temporary File Local Information Disclosure
- Privilege escalation
- CWE-378
<3.4.0 · fixed in 3.4.0
GHSA-f5fw-25gw-5m92 · CVE-2024-23454 - CVSS 8.5 High
Point B Ltd Getscreen Agent MSI Installer getscreen.msi temp file
- Point B Ltd Getscreen Agent
- CWE-377
- CWE-378
- CVSS 7.8 High
The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation.
- CWE-378
- CVSS 9.3 CriticalCritical · CVSS 9+
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).
- Siemens SINEMA Remote Connect Server
- CWE-378
- CVSS 5.9 Medium
JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions.
- CWE-378
- CVSS 5.2 Medium
Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability.
- Zoom Video Communications, Inc. Zoom for macOS Client
- CWE-378
- CVSS 3.3 Low
A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1).
- Siemens SCALANCE LPE9403
- CWE-378
- CVSS 3.3 Low
RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions
- Information disclosure
- CWE-378
<3.0.0.Alpha4 · fixed in 3.0.0.Alpha4
GHSA-j75r-vf64-6rrh · CVE-2023-0481 - CVSS 5.5 Medium
Duplicate Advisory: Insecure Temporary File in RESTEasy
- CWE-378
<4.7.8.Final || >=5.0.0.Alpha1, <5.0.6.Final || >=6.0.0.Beta1, <6.2.3.Final · fixed in 4.7.8.Final, 5.0.6.Final, 6.2.3.Final
GHSA-jrmh-v64j-mjm9 - CVSS 5.6 Medium
Creation of Temporary File With Insecure Permissions in logilab-commons
- CWE-378
<0.61.0 · fixed in 0.61.0
GHSA-g5m2-22h2-rr3j · CVE-2014-1839 - CVSS 5.5 Medium
Local Information Disclosure Vulnerability in io.netty:netty-codec-http
- Information disclosure
- CWE-378
<4.1.77.Final · fixed in 4.1.77.Final
GHSA-269q-hmxg-m83q · CVE-2022-24823 - CVSS 7.8 High
Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability.
- Dell PowerScale OneFS
- CWE-378
- CVSS 6.2 Medium
Avaya Aura Device Services Arbitrary Code Execution Vulnerability
- Avaya Aura Devices Services
- CWE-378
- CVSS 6.2 Medium
Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code
- Privilege escalation
- Information disclosure
<5.1.0 · fixed in 5.1.0
GHSA-cqxr-xf2w-943w · CVE-2021-21430 - CVSS 9.3 CriticalCritical · CVSS 9+
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator
- Privilege escalation
- Information disclosure
<5.1.0 · fixed in 5.1.0
GHSA-23x4-m842-fmwf · CVE-2021-21428 - CVSS 7.0 High
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
- Cisco AnyConnect Secure Mobility Client
- CWE-378
- CVSS 7.0 High
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
- Cisco AnyConnect Secure Mobility Client
- CWE-378
- CVSS 7.0 High
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
- Cisco AnyConnect Secure Mobility Client
- CWE-378
- CVSS 7.0 High
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
- Cisco AnyConnect Secure Mobility Client
- CWE-378
- CVSS 7.0 High
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
- Cisco AnyConnect Secure Mobility Client
- CWE-378
- CVSS 7.0 High
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
- Cisco AnyConnect Secure Mobility Client
- CWE-378
- CVSS 4.0 Medium
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
- Information disclosure
- CWE-377
<5.1.0 · fixed in 5.1.0
GHSA-867q-77cc-98mv · CVE-2021-21429 - CVSS 6.2 Medium
Local information disclosure via system temporary directory
- Information disclosure
- Broken access control
>=2.28, <2.34 || >=3.0.0, <3.0.2 · fixed in 2.34, 3.0.2
GHSA-c43q-5hpj-4crv · CVE-2021-28168 - CVSS 7.8 High
hawk: Insecure file permissions
- SUSE Linux Enterprise High Availability 12-SP3
- SUSE Linux Enterprise High Availability 12-SP5
- CWE-378
- CVSS 8.8 High
Local privilege escalation through system temporary directory
- gradle
- CWE-378
- CWE-379
- CVSS 3.3 Low
Information Disclosure in Guava
- Information disclosure
- Broken access control
<32.0.0-android · fixed in 32.0.0-android
GHSA-5mg8-w23w-74h3 · CVE-2020-8908 - CVSS 5.3 Medium
Generated Code Contains Local Information Disclosure Vulnerability
- Information disclosure
- Broken access control
<2.4.19 · fixed in 2.4.19
GHSA-hpv8-9rq5-hq7w · CVE-2021-21364 - CVSS 5.3 Medium
Generator Web Application: Local Privilege Escalation Vulnerability via System Temp Directory
- CWE-378
- CWE-379
<2.4.19 · fixed in 2.4.19
GHSA-pc22-3g76-gm6j · CVE-2021-21363 - CVSS 3.0 Low
Local Information Disclosure Vulnerability
- CWE-378
- CWE-379
>=1.0.0-beta.6, <1.0.0-beta.9 · fixed in 1.0.0-beta.9
GHSA-2cxf-6567-7pp6 · CVE-2021-21331 - CVSS 6.2 Medium
Local Information Disclosure Vulnerability in Netty on Unix-Like systems
- Information disclosure
- CWE-378
* · no fixed version yet
GHSA-5mcr-gq6c-3hq2 · CVE-2021-21290 - CVSS 7.0 High
Local Temp Directory Hijacking Vulnerability
- Information disclosure
- CWE-378
<9.4.33.v20201020 || >=10.0.0.beta1, <10.0.0.beta3 || >=11.0.0.beta1, <11.0.0.beta3 · fixed in 9.4.33.v20201020, 10.0.0.beta3, 11.0.0.beta3
GHSA-g3wg-6mcf-8jj6 · CVE-2020-27216 -
On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can obtain administrator privileges on the endpoint because it fails t…
- Microsoft Windows SecureConnector agent
- CWE-378