A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
CVSS Details
- CVSS 3.1 Base Score: 3.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution existsUpgrade guava-libraries | May 15, 2025 | Dec 10, 2020 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Dell Powerstore Dsa2024287 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jul 2, 2024 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35560771 for version 14.1.1.0.0. | Jul 25, 2022 | Dec 10, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 8, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Dec 10, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 10, 2020 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.5Upgrade Splunk Enterprise to version 9.0.10Upgrade Splunk Enterprise to version 9.2.2 | Sep 30, 2025 | Dec 10, 2020 |
| Suse | — | Upgrade guavaUpgrade guava20Upgrade guava-javadocUpgrade guava-testlibUpgrade guava20-javadocUpgrade guava20-testlib | Aug 9, 2024 | Dec 10, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub