https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:26:21.475305+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-22234 EUVD-2026-22234 2026-10-04T08:26:21.481353+00:00 EUVD-2026-22234 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21430 fkie_cve-2021-21430 2026-10-04T08:26:21.481443+00:00

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. Affected generators: `java` (jersey2, okhttp-gson (default library)), `scala-finch`. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

 https://cve.radiocsirt.org/vuln/ghsa-cqxr-xf2w-943w GHSA-cqxr-xf2w-943w — Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code 2026-10-04T08:26:21.481510+00:00

Affected: Maven: org.openapitools:openapi-generator

### Impact

**This vulnerability impacts generated code.** If this code was generated as a one-off occasion, not as a part of an automated CI/CD process, this code will remain vulnerable until fixed manually!

On Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default `umask` settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions `-rw-r--r--` and `drwxr-xr-x` respectively, unless an API that explicitly sets safe file permissions is used.

This vulnerability exists due to the use of the JDK method `File.createTempFile`. This method creates an insecure temporary files that can leave application and system data vulnerable to exposure.

Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. For example, if the API endpoint returns a PDF file, the auto-generated clients will first download the PDF into a insecure temporary file that can be read by anyone on the system.

Affected generators: - Java - `okhttp-gson` (default library) https://github.com/OpenAPITools/openapi-generator/blob/d85f61ff0cfd6b8cd7063a63f302998a51466269/modules/openapi-generator/src/main/resources/Java/libraries/okhttp-gson/ApiClient.mustache#L1085-L1088 - `jersey2` https://github.com/OpenAPITools/openapi-generator/blob/d85f61…

 https://cve.radiocsirt.org/vuln/gsd-2021-21430 gsd-2021-21430 2026-10-04T08:26:21.481571+00:00 gsd-2021-21430