RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions

published 2023-02-24 3 y ago modified 2026-06-17 4 mo ago also GHSA-j75r-vf64-6rrh , EUVD-2023-0730

cvss: 3.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits: 0; none known

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.

Patch / fix

fixed in 2 links 2

maven io.quarkus.resteasy.reactive:resteasy-reactive-common 3.0.0.Alpha4
quarkus quarkus 2.16.1

github.com/quarkusio/quarkus@95d5904 commit
github.com/quarkusio/quarkus#30694 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-0481 updated 2026-08-04 cvss 5.3

quarkus: insecure permissions on temp files

Red Hat build of Quarkus 2.13.8.Final resteasy-reactive-common 2.13.8.Final-redhat-00004
fixed: vendor fix RHSA-2023:3809
Red Hat build of Quarkus 2.13.8.Final jna 5.8.0, bson 4.7.2, db2 1.17.3, h2 2.1.214, jansi 1.18, jdom 1.1.3, +872 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 19 mo ago (2025-03-12)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	io.quarkus.resteasy.reactive:resteasy-reactive-common	<3.0.0.Alpha4	3.0.0.Alpha4

Affected products

n/a Quarkus

Classification

Weakness

CWE-378 Creation of Temporary File With Insecure Permissions
CWE-668 Exposure of Resource to Wrong Sphere

References

github.com /quarkusio/quarkus/pull/30694
web, patch, vendor-advisory
github.com /quarkusio/quarkus/commit/95d5904f7cf18c8165b97d8ca03b203d7f69c17e
web
nvd.nist.gov /vuln/detail/CVE-2023-0481
advisory
github.com /quarkusio/quarkus
package

Sources

CVE List CVE-2023-0481
GitHub Advisory GHSA-j75r-vf64-6rrh
NVD CVE-2023-0481

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary