CVE-2026-35342Low· 3.3▾ Sunlitmktemp: empty TMPDIR creates temp files in CWD instead of /tmp
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.2%
The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.
Zellic finding 3.11. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
uu_mktemp < 0.6.0Upgrade to a patched release:
uu_mktemp 0.6.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93864High· 7.1Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
CVE-2026-76497Medium· 6.6Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities
CVE-2026-113713Medium· 4.4virtualenv: Temporary app-data can leave dangling seed package links
CVE-2025-14307High· 8.1An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6
CVE-2026-64672MediumTerragrunt catalog predictable temp symlink clobber
CVE-2026-55480Medium· 5.7OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems