In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
| Link | Tags |
|---|---|
| https://github.com/quarkusio/quarkus/pull/30694 | patch vendor advisory |