In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
CallBackery versions prior to 0.62.0 for Perl create a temporary configuration database dump file in /tmp with insecure permissions. This file is world-readable and not deleted after creation, exposing sensitive data including password hashes. Local users can read the dump or redirect it via a symlink to arbitrary files, leading to potential information disclosure.
A vulnerability in PHPUnit versions 13.4.0 through 13.4.3 allows local attackers on multi-user systems with shared temporary directories to execute arbitrary code with developer privileges. This occurs because the framework creates temporary files in a predictable directory under sys_get_temp_dir() without verifying ownership or permissions. The issue is fixed in version 13.4.4.
GnuPG version 2.5.21 for Windows has a critical vulnerability due to incorrect permission assignment on the C:\ProgramData directory. This allows low-privilege users to create arbitrary subdirectories and inject malicious configuration files that GnuPG components will consume, potentially leading to code execution under the victim user's security context.
The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a directory or FIFO already exists at that path when the agent (re)starts, the agent reuses it based only on an existence and/or file-type check, without validating its owner or permissions. A local, unprivileged user with write access to the same base directory (by default under `$TMPDIR/ankaios`, e.g. shared `/tmp`) can pre-create this path hierarchy, including the two Control Interface FIFOs, before the agent starts. The agent then treats the attacker-owned FIFOs as the legitimate Control Interface for the targeted workload. The attacker can complete the Control Interface handshake and issue requests using that workload's configured `controlInterfaceAccess` permissions, allowing impersonation of the workload and, depending on its configured permissions, unauthorized reading and/or modification of the cluster's desired state.
CVE-2026-69482 is a vulnerability in Microsoft Windows 10 where the Windows Error Reporting component creates temporary files in directories with insecure permissions. This flaw allows an authorized local attacker to tamper with these temporary files, potentially leading to elevated impact on confidentiality and integrity. The issue affects multiple Windows 10 versions prior to their respective fixed releases. An official fix is available from Microsoft.
CVE-2026-85028 is a vulnerability in the AWS FPGA Development Kit (aws-fpga) prior to version 2.3.4. It involves the creation of a temporary file in a directory with insecure permissions during the FPGA management tool installation. This flaw could allow local users to execute arbitrary code with root privileges by placing crafted shell content in a predictable, world-writable temporary directory that the installation process reads after privilege escalation. The issue is fixed in version 2.3.4.
CVE-2026-82346 is a high-severity vulnerability in HP ImageDiags prior to version 5.0.0.36. It involves the creation of temporary files in directories with insecure permissions, potentially allowing a local attacker to escalate privileges due to insufficient access controls. The vulnerability requires local access and user interaction to exploit. No official patch or remediation guidance has been provided yet.
Dell Alienware Area 51m R2 BIOS contains a vulnerability involving improper link resolution before file access, allowing a low privileged local attacker to potentially perform arbitrary writes. This issue arises from the creation of temporary files in directories with insecure permissions. The vulnerability has a medium severity rating with a CVSS score of 6.6.
Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.
NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at `src/platform/windows/misc.cpp` lives at `C:\ProgramData\LuminalShine\config\apps.json` and is created by the `SYSTEM` service. Under Windows' default `C:\ProgramData` inheritance, that gives `BUILTIN\Users` only Read+Execute — not writable — so the canonical EoP doesn't actually trigger on a vanilla install. Version 26.05.0-rc4 contains a patch for the issue. As a workaround, use default condition DACLs for `ProgramData`.
The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.
A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.
# Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process.
## Info
The vulnerable code path affected temporary extension package sources loaded with `--extension` or `-e`, specifically npm and git package sources. The temporary npm install root and temporary git clone paths were deterministic and rooted under `os.tmpdir()/pi-extensions`. The path was derived from public source information rather than from a per-user private directory or an unpredictable temporary directory.
During resource resolution, pi considered an npm package or git checkout present if the expected package path already existed. Extension resources discovered from that package location were then loaded by the extension loader. Because extensions execute with the same privileges as the invoking pi process, pre-created temporary package contents could execute as the victim user.
The issue primarily affects Linux-based multi-user hosts where the operating system temporary directory is shared across user accounts, such as shared development machines, CI runners, HPC login nodes, and similar environments. On Windows and macOS, the default temporary directory is typically user-scoped, so default configurations are not expected to be affected unless the temporary directory is overridden to a shared writable location.
## Impact
A local attacker with access to the same host can exploit this only if a victim runs a vulnerable pi version with a temporary npm or git extension package source that maps to the attacker-prepared location. No network attack path is involved and no race must be won, but victim interaction is required.
Successful exploitation can allow arbitrary extension code execution as the victim user. This can expose or modify files accessible to that user and can also cause denial of service or data loss through malicious package contents or unsafe temporary cache entries.
## Affected versions
- `@earendil-works/pi-coding-agent`: affected `>= 0.74.0, < 0.78.1`; patched `>= 0.78.1`
- `@mariozechner/pi-coding-agent`: affected `>= 0.50.0, <= 0.73.1`; no patched version was released under the old package name. Migrate to `@earendil-works/pi-coding-agent >= 0.78.1`.
## The solution
Version 0.78.1 moves temporary extension package installs to a private per-user directory under `~/.pi/agent/tmp/extensions` and enforces `0700` permissions on that directory. The same release also hardens git package source path handling so managed clone paths remain inside their intended install roots.
## Recommendations
Upgrade to `@earendil-works/pi-coding-agent` version 0.78.1 or later. Users of the deprecated `@mariozechner/pi-coding-agent` package should migrate to the `@earendil-works/pi-coding-agent` package and upgrade to a fixed version.
On shared Linux hosts, avoid using temporary npm or git extension package sources with vulnerable versions. Review any third-party extensions before loading them, because pi extensions run with full access to the invoking user's account.
## Workarounds
If upgrading immediately is not possible, avoid `--extension` or `-e` with npm or git package sources on shared Linux systems. As an additional mitigation for vulnerable versions, configure the process temporary directory environment to point at a directory owned by the invoking user with `0700` permissions before starting pi.
## Timeline
- 2026-05-29: Report received
- 2026-06-02: Fix committed
- 2026-06-04: Fixed version 0.78.1 released
- 2026-06-08: Advisory prepared for publication
## Credits
Reported by Paul Urian and Cosmin Alexa of CrowdStrike.
OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.
Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.
In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.
CVE-2025-64896 is a medium severity vulnerability in Adobe Creative Cloud Desktop versions 6.4.0.361 and earlier, involving the creation of temporary files in directories with incorrect permissions (CWE-379). This flaw can be exploited by an attacker to cause a denial-of-service (DoS) condition by manipulating these temporary files, disrupting application functionality. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are currently reported in the wild. Organizations using affected Adobe Creative Cloud Desktop versions should prioritize patching once available and implement strict file permission policies to mitigate risk. European countries with high usage of Adobe Creative Cloud, especially in creative industries, are more likely to be impacted.