CVE-2026-126823 is a vulnerability in the MongoDB Atlas SQL JDBC Driver versions 2.2.1 through 4.0.1. A local user with an ordinary account on the same host can place a file in a shared temporary location that the driver's native library loading routine will load without verifying its origin. This can lead to arbitrary code execution within the Java application process, potentially causing data disclosure, data alteration, or process unavailability.
CVE-2026-111241 is a vulnerability in Apache TomEE where passivated stateful session beans are stored in predictably named temporary files in a shared system directory. A local attacker with write access to this directory can read or manipulate these files, potentially causing the server to deserialize malicious data and execute arbitrary code. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.
CVE-2026-64672 is a vulnerability in terragrunt versions prior to 1.1.1 where the catalog command follows a symlink in a predictable temporary directory. A local attacker with write access to the temporary directory can redirect operations to delete and replace directories outside the intended root, but exploitation requires local access and user interaction. The issue is fixed in version 1.1.1.
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.
CVE-2026-97209 is an insecure temporary file vulnerability in Elixir's Mix deps.partition feature affecting versions from 1.20.0-rc.4 up to but not including 1.20.5. It allows a local user on the same host to execute code as another user by exploiting a race condition where a partition configuration file in a shared temporary directory can be replaced by an attacker before being read by the partition VM. This vulnerability is fixed in version 1.20.5.
CVE-2026-93864 is a path traversal vulnerability in WatchGuard Fireware OS's firewall daemon. It allows a local attacker with low-privileged code execution to overwrite arbitrary files with root privileges by planting a crafted file system object and triggering a list update. This can also lead to tampering with firewall IP set data. The vulnerability affects multiple versions of Fireware OS and has been assigned a high severity rating.
A vulnerability in pypa virtualenv versions 21.14.8 through 21.14.9 allows insecure temporary file handling. The app-data seeder can create environments linked to temporary package files that are deleted after creation, but certain environment-variable and configuration-file settings can enable this insecure state even when the command-line flag is disabled. This causes the environment to depend on a cache pathname no longer controlled by its owner. The issue is fixed in version 21.14.10.
CVE-2026-55480 is a vulnerability in OpenPrinting CUPS prior to version 2.4.20 where a race condition in the copy_model() function allows a privileged process to follow a symlink and overwrite arbitrary root-writable files. This occurs because a temporary file path is created in a group-writable directory without secure flags, enabling symlink attacks. Exploitation requires an attacker with lp-group write access and a privileged add-printer or modify-printer operation. The issue is fixed in version 2.4.20.
CVE-2026-82715 is an insecure temporary file vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. It affects versions 01-00 of the AIX driver and 01-04 of the Virtual I/O Server driver prior to 01-23-/A. The vulnerability could allow an attacker with local privileges to cause high impact on integrity and availability. The CVSS score is 7.9 (high severity).
A vulnerability in the codefori vscode-ibmi Visual Studio Code extension prior to version 3.0.1 allows insecure handling of temporary files. Specifically, Object Browser downloads and edit-save flow content are stored in the shared /tmp directory without reliable cleanup, potentially exposing file contents to other local users on the system. This issue is resolved in version 3.0.1.
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.
Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering.
CVE-2026-47852 is a high-severity vulnerability in Spring AI versions 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and 2.0.0. It allows a local attacker on a multi-user system to pre-create a deterministic cache path and place a malicious ONNX model file, potentially leading to integrity compromise. The vulnerability is related to insecure handling of temporary files (CWE-377). No official patch or remediation guidance is currently available.
Faktory versions prior to 1.10.0 contain an insecure temporary file vulnerability in the embedded Redis bootstrapper. The service writes its startup configuration to a fixed, world-writable path (/tmp/redis.conf) without proper validation, allowing local unprivileged users to supply malicious Redis directives. This can expose the job queue over an unauthenticated network port and enable arbitrary code execution as root via a malicious loadmodule directive. The issue is fixed in version 1.10.0.
Etherpad versions prior to 3.1.0 contain a vulnerability in the ImportHandler and ExportHandler modules where temporary filenames are derived from Math.random() and placed in a world-writable temporary directory. This allows a local unprivileged attacker who can predict the filename to create a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations may follow this link and overwrite the target file with attacker-controlled content. The issue is fixed in version 3.1.0.
CVE-2026-53759 is an insecure temporary file vulnerability in linuxfabrik monitoring-plugins prior to version 4.2.0. The db_sqlite.py module created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links. This allowed a local attacker with monitoring account access to cause a root process to overwrite arbitrary files or manipulate SQLite databases by exploiting symbolic link targets. The issue is fixed in version 4.2.0 by moving plugin caches to secured per-user directories.