-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure temporary file handling in the upload_project function. The pre-patch code used timestamp-based filenames in /tmp (e.g., '/tmp/fab.%s.tar') which are predictable. Attackers could exploit this by creating symlinks at these paths. The commit 3445b56 fixed this by introducing mkdtemp for secure temporary directory creation, confirming the vulnerability resided in this function. The CVE description explicitly references '/tmp/fab.*.tar' files, which are directly tied to this function's pre-patch behavior.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fabric | pip | < 1.1.0 | 1.1.0 |
Ongoing coverage of React2Shell