Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator

published 2021-05-10 5 y ago modified 2026-07-08 4 mo ago also GHSA-23x4-m842-fmwf , EUVD-2021-0893

cvss: 9.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits: 0; none known

Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

Patch / fix

fixed in 2 links 1

maven org.openapitools:openapi-generator-online 5.1.0
openapi-generator openapi_generator 5.1.0

github.com/OpenAPITools/openapi-generator#8788 pull request

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-23x4-m842-fmwf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.4	AV:L/AC:M/Au:N/C:P/I:P/A:P
GitHub	3.1	9.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.openapitools:openapi-generator-online	<5.1.0	5.1.0

Affected products

OpenAPITools openapi-generator

Classification

Weakness

CWE-269 Improper Privilege Management
CWE-668 Exposure of Resource to Wrong Sphere
CWE-377 DEPRECATED: Insecure Temporary File
CWE-378 Creation of Temporary File With Insecure Permissions
CWE-379 Creation of Temporary File in Directory with Insecure Permissions

References

github.com /OpenAPITools/openapi-generator/pull/8788
web, patch, third-party-advisory
github.com /OpenAPITools/openapi-generator/security/advisories/GHSA-23x4-m842-fmwf
web, exploit, third-party-advisory
github.com /swagger-api/swagger-codegen/security/advisories/GHSA-pc22-3g76-gm6j
web
nvd.nist.gov /vuln/detail/CVE-2021-21428
advisory
github.com /OpenAPITools/openapi-generator
package
github.com /OpenAPITools/openapi-generator/blob/c6530519975341d7784a252132b2f0854f488901/modules/openapi-generator-online
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary