CVE-2026-49134

CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp File

CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges via bash, allowing a same-user local process to rewrite the installer body before the administrator prompt is approved, causing attacker-controlled commands to run as root.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Steipete

Products

Codexbar

CVE-2026-49135

CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Steipete

Products

Codexbar

CVE-2026-35342

uutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIR

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Uutils

Products

Coreutils

CVE-2026-40973

Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory

A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Boot Spring Boot

CVE-2026-40979

Exposure of ONNX Model via Shared Environment in Spring AI

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Spring Ai

CVE-2025-67223

Unrestricted Access to Sensitive Files via Predictable Log Names in Aranda File Server

The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arandasoft

Products

Aranda File Server

CVE-2026-4822

Enter Software Iperius Backup Backup Service temp file

A vulnerability was detected in Enter Software Iperius Backup up to 8.7.3. Affected is an unknown function of the file C:\ProgramData\IperiusBackup\Jobs\ of the component Backup Service. Performing a manipulation results in creation of temporary file with insecure permissions. The attack is only possible with local access. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit is now public and may be used. Upgrading to version 8.7.4 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Enter Software

Products

Iperius Backup

CVE-2007-6209

zsh insecure /tmp file usage

Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Zsh

Products

Linux Kernel Zsh

CVE-2008-6552

rgmanager: multiple insecure temporary file use issues

Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Cluster Project Cman and 4 more

CVE-2007-3852

sysstat insecure temporary file usage

The init script (sysstat.in) in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely, which allows local users to execute arbitrary code.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Sysstat

Products

Enterprise Linux Sysstat

CVE-2007-6061

Audacity insecure temporary file handling

Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service (recording deadlock) by creating the directory before Audacity is run. NOTE: this issue can be leveraged to delete arbitrary files or directories via a symlink attack.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Audacityteam

Products

Audacity

CVE-2008-4639

jhead: insecure temporary file usage

jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Sentex

Products

Jhead

CVE-2009-1893

dhcp: insecure temporary file use in the dhcpd init script

The configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise Linux (RHEL) 3 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file, related to the "dhcpd -t" command.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Isc Redhat

Products

Dhcp Enterprise Linux

CVE-2007-3919

xen xenmon.py / xenbaked insecure temporary file accesss

(1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm.

CVSS 2.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Redhat Xensource Inc

Products

Debian Linux Enterprise Linux Xen

CVE-2007-5936

dviljk uses insecure temporary file

dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Tetex Tug

Products

Tetex Texlive 2007

CVE-2008-4474

freeradius: dialupadmin insecure temporary file usage

freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Freeradius

Products

Freeradius

CVE-2008-4579

cman/fence: insecure temporary file usage in the apc fence agents

The (1) fence_apc and (2) fence_apc_snmp programs, as used in (a) fence 2.02.00-r1 and possibly (b) cman, when running in verbose mode, allows local users to append to arbitrary files via a symlink attack on the apclog temporary file.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Gentoo Redhat

Products

Cman Fence Enterprise Linux and 1 more

CVE-2008-4580

cman/fence: insecure temporary file usage in the manual fence agent

fence_manual, as used in fence 2.02.00-r1 and possibly cman, allows local users to modify arbitrary files via a symlink attack on the fence_manual.fifo temporary file.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Gentoo

Products

Cman Fence

CVE-2008-4192

cman/fence: insecure temporary file usage in the egenera fence agent

The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cman Enterprise Linux Rhel Cluster

CVE-2008-1694

emacs insecure /tmp file usage

vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu

Products

Emacs Sccs