{"id":"CVE-2025-48382","aliases":["GHSA-g88v-2j67-9rmx"],"url":"https://o3.security/vulnerability/CVE-2025-48382","summary":"Fess has Insecure Temporary File Permissions","details":"### Summary\nFess (an open-source Enterprise Search Server) creates temporary files without restrictive permissions, which may allow local attackers to read sensitive information from these temporary files.\n\n### Details\nThe `createTempFile()` method in `org.codelibs.fess.helper.SystemHelper` creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files.\n\n### Impact\nThis issue primarily affects environments where Fess is deployed in a shared or multi-user context. Typical single-user or isolated deployments have minimal or negligible practical impact.\n\n### Workarounds\nEnsure local access to the environment running Fess is restricted to trusted users only.\n\n### References\n- [CVE-2022-24823: Netty temporary file permissions vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2022-24823)","published":"2025-05-27T04:32:23.804Z","modified":"2026-08-12T14:52:45.033579Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.codelibs.fess:fess","fixedVersion":"14.19.2"}],"fix":{"url":"https://github.com/codelibs/fess/commit/25b2009fea2a0f6ccd5aa8154aa54b536c08f6c4","label":"codelibs/fess@25b2009"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48382.json"},{"type":"ADVISORY","url":"https://github.com/codelibs/fess/security/advisories/GHSA-g88v-2j67-9rmx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48382"},{"type":"FIX","url":"https://github.com/codelibs/fess/commit/25b2009fea2a0f6ccd5aa8154aa54b536c08f6c4"},{"type":"PACKAGE","url":"https://github.com/codelibs/fess"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T14:52:45.033579Z"}}