CWE-378 创建拥有不安全权限的临时文件 类弱点 35 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-378属于临时文件权限配置不当漏洞。当应用程序创建临时文件时若未设置严格权限，攻击者可利用此缺陷通过符号链接攻击或竞态条件，读取敏感数据或篡改文件内容以执行恶意代码。开发者应避免使用默认权限，需显式指定仅所有者可读写，并采用原子性操作确保文件创建与权限设置的同步，从而防止未授权访问。
FILE *stream; if( (stream = tmpfile()) == NULL ) { perror("Could not open new temporary file\n"); return (-1); } // write data to tmp file ... // remove tmp file rmtmp();try { File temp = File.createTempFile("pattern", ".suffix"); temp.deleteOnExit(); BufferedWriter out = new BufferedWriter(new FileWriter(temp)); out.write("aString"); out.close(); } catch (IOException e) { }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-4137 | MLflow 安全漏洞 — mlflow/mlflow | - | - | 2026-05-18 |
| CVE-2026-33572 | OpenClaw 安全漏洞 — OpenClaw | 8.4 | High | 2026-03-29 |
| CVE-2026-4822 | Iperius Backup 安全漏洞 — Iperius Backup | 7.0 | High | 2026-03-25 |
| CVE-2025-46685 | Dell SupportAssist OS Recovery 安全漏洞 — SupportAssist OS Recovery | 7.5 | High | 2026-01-13 |
| CVE-2025-46684 | Dell SupportAssist OS Recovery 安全漏洞 — SupportAssist OS Recovery, | 6.6 | Medium | 2026-01-13 |
| CVE-2025-34352 | JumpCloud Remote Assist 安全漏洞 — Remote Assist | 7.8AI | High AI | 2025-12-02 |
| CVE-2025-7647 | LlamaIndex 安全漏洞 — run-llama/llama_index | 8.8 | - | 2025-09-27 |
| CVE-2025-4953 | Podman 安全漏洞 | 7.4 | High | 2025-09-16 |
| CVE-2025-9474 | Mihomo Party 安全漏洞 — Party | 4.5 | Medium | 2025-08-26 |
| CVE-2025-38747 | Dell SupportAssist OS Recovery 安全漏洞 — SupportAssist OS Recovery | 7.8 | High | 2025-08-06 |
| CVE-2025-32438 | Nixpkgs 安全漏洞 — nixpkgs | 8.8 | High | 2025-04-15 |
| CVE-2025-27148 | Gradle 安全漏洞 — gradle | 8.8 | High | 2025-02-25 |
| CVE-2024-52543 | Dell NativeEdge 安全漏洞 — NativeEdge | 6.5 | Medium | 2024-12-25 |
| CVE-2024-47884 | foxmarks 安全漏洞 — foxmarks | 5.0AI | Medium AI | 2024-10-11 |
| CVE-2024-23454 | Apache Hadoop 安全漏洞 — Apache Hadoop | 5.5AI | Medium AI | 2024-09-25 |
| CVE-2024-7358 | Point B Getscreen 安全漏洞 — Getscreen Agent | 7.8 | High | 2024-08-01 |
| CVE-2024-39872 | Siemens SINEMA Remote Connect Server 安全漏洞 — SINEMA Remote Connect Server | 9.6 | Critical | 2024-07-09 |
| CVE-2023-28600 | Zoom Client 安全漏洞 — Zoom for macOS Client | 5.2 | Medium | 2023-06-13 |
| CVE-2023-27408 | Siemens SCALANCE 安全漏洞 — SCALANCE LPE9403 | 3.3 | Low | 2023-05-09 |
| CVE-2023-0481 | Quarkus 安全漏洞 — Quarkus | 3.3 | - | 2023-02-24 |
| CVE-2023-0482 | Resteasy 安全漏洞 — RESTEasy | 5.5 | - | 2023-02-17 |
| CVE-2022-24411 | Dell Technologies Dell PowerScale OneFS 安全漏洞 — PowerScale OneFS | 7.8 | High | 2022-04-12 |
| CVE-2021-25654 | Avaya Aura Device Services 代码注入漏洞 — Avaya Aura Devices Services | 6.2 | Medium | 2021-06-25 |
| CVE-2021-1426 | Cisco AnyConnect Secure Mobility Client for Windows 代码问题漏洞 — Cisco AnyConnect Secure Mobility Client | 7.0 | High | 2021-05-06 |
| CVE-2021-1427 | Cisco AnyConnect Secure Mobility Client for Windows 代码问题漏洞 — Cisco AnyConnect Secure Mobility Client | 7.0 | High | 2021-05-06 |
| CVE-2021-1496 | Cisco AnyConnect Secure Mobility Client for Windows 代码问题漏洞 — Cisco AnyConnect Secure Mobility Client | 7.0 | High | 2021-05-06 |
| CVE-2021-1429 | Cisco AnyConnect Secure Mobility Client for Windows 代码问题漏洞 — Cisco AnyConnect Secure Mobility Client | 7.0 | High | 2021-05-06 |
| CVE-2021-1430 | Cisco AnyConnect Secure Mobility Client for Windows 代码问题漏洞 — Cisco AnyConnect Secure Mobility Client | 7.0 | High | 2021-05-06 |
| CVE-2021-1428 | Cisco AnyConnect Secure Mobility Client for Windows 代码问题漏洞 — Cisco AnyConnect Secure Mobility Client | 7.0 | High | 2021-05-06 |
| CVE-2021-28168 | Maxim Nesen jersey 安全漏洞 — Eclipse Jersey | 6.2 | Medium | 2021-04-22 |
CWE-378（创建拥有不安全权限的临时文件） 是常见的弱点类别，本平台收录该类弱点关联的 35 条 CVE 漏洞。