N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48382

CVE-2025-48382: Fess has Insecure Temporary File Permissions

Summary

Fess (an open-source Enterprise Search Server) creates temporary files without restrictive permissions, which may allow local attackers to read sensitive information from these temporary files.

Details

The createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files.

Impact

This issue primarily affects environments where Fess is deployed in a shared or multi-user context. Typical single-user or isolated deployments have minimal or negligible practical impact.

Workarounds

Ensure local access to the environment running Fess is restricted to trusted users only.

References

CVE-2022-24823: Netty temporary file permissions vulnerability

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48382

CVE-2025-48382:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.codelibs.fess:fess	maven	< 14.19.2	14.19.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the createTempFile method within the org.codelibs.fess.helper.SystemHelper class. The provided commit 25b2009fea2a0f6ccd5aa8154aa54b536c08f6c4 shows modifications to this exact method. Specifically, the patch adds calls to file.setReadable(false, false), file.setReadable(true, true), file.setWritable(false, false), and file.setWritable(true, true). These additions are to ensure that the temporary file created by File.createTempFile(prefix, suffix) has its permissions explicitly restricted to the owner. Before this change, the method created temporary files relying on default system permissions, which could be overly permissive, leading to the described information disclosure vulnerability (CWE-732). The vulnerability description also directly points to org.codelibs.fess.helper.SystemHelper.createTempFile() as the problematic method. Therefore, this function is identified as vulnerable because, prior to the patch, it did not enforce secure file permissions on the temporary files it created, making their contents potentially accessible to other local users on the system.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.