CVE-2026-126627: Apache XML Graphics FOP: TemporaryFolder on unix-like systems does not limitaccess to created files
Severity: low
32
CVE-2026-126627
Insecure temp file permissions in Apache XML Graphics FOP
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache XML Graphics FOP creates temporary files with insecure permissions. On Unix-like systems, TemporaryFolder does not restrict access to those files, so a local user who can reach the temporary directory may read or alter them. Versions through 2.11 are affected.
What to do: Upgrade Apache XML Graphics FOP to 2.12, which fixes the insecure temporary-file permissions.
| Product | Affected | Fixed in |
|---|---|---|
| Apache XML Graphics FOP | through 2.11 | 2.12 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
- Weakness
- CWE-378