GitHub Advisoryadvisory · Maven

GHSA-g88v-2j67-9rmx Fess has Insecure Temporary File Permissions

LOW Published 2025-05-27 Modified 2025-05-28 Official page ↗
Aliases
CVE-2025-48382
Ecosystem
Maven
Packages
org.codelibs.fess:fess
Severity
Low
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-732
Reviewed
2025-05-27

Affected packages

• Maven org.codelibs.fess:fess: < 14.19.2 → fixed in 14.19.2

Description

Summary Fess (an open-source Enterprise Search Server) creates temporary files without restrictive permissions, which may allow local attackers to read sensitive information from these temporary files. Details The `createTempFile()` method in `org.codelibs.fess.helper.SystemHelper` creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files. Impact This issue primarily affects environments where Fess is deployed in a shared or multi-user context. Typical single-user or isolated deployments have minimal or negligible practical impact. Workarounds Ensure local access to the environment running Fess is restricted to trusted users only. References • CVE-2022-24823: Netty temporary file permissions vulnerability

Related

Alias · CVE (1)

  • CVE-2025-48382 Fess is a deployable Enterprise Search Server. vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References