Every CVESearch/Get API key

CVE-2026-126627

Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local users

No score

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: through 2.11.

Users are recommended to upgrade to version 2.12, which fixes the issue.

Exploit likelihood

0.21%Scored on 2026-11-12. The trend appears after a second daily score.

What each source reports

CVE ListNo score

Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local users

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: through 2.11.

Users are recommended to upgrade to version 2.12, which fixes the issue.

Record
CVE-2026-126627
Weakness
CWE-378
Updated
2026-11-11
EUVDEUVD-2026-123361No score

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: through 2.11.

Users are recommended to upgrade to version 2.12, which fixes the issue.

Record
EUVD-2026-123361
Updated
2026-11-11
GitHub AdvisoriesGHSA-77r6-35jh-hcr9No score

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. ...

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: through 2.11.

Users are recommended to upgrade to version 2.12, which fixes the issue.

Record
GHSA-77r6-35jh-hcr9
Weakness
CWE-378
Updated
2026-11-11
NVDNo score

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: through 2.11.

Users are recommended to upgrade to version 2.12, which fixes the issue.

Record
CVE-2026-126627
Weakness
CWE-378
Updated
2026-11-11
OSVDEBIAN-CVE-2026-126627No score

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

Record
DEBIAN-CVE-2026-126627
Updated
2026-11-13
OSVUBUNTU-CVE-2026-126627No score

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

Record
UBUNTU-CVE-2026-126627
Updated
2026-11-13

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fop
Debian:12
All versions, plus listed versions
1:2.10+dfsg-11:2.10+dfsg-1~exp01:2.10+dfsg-1~exp11:2.10+dfsg-21:2.10+dfsg1-1
Show 5 moreShow less
1:2.10+dfsg1-21:2.10+dfsg1-31:2.10+dfsg1-41:2.8-21:2.8-3
None known
fop
Debian:13
All versions, plus listed versions
1:2.10+dfsg-21:2.10+dfsg1-11:2.10+dfsg1-21:2.10+dfsg1-31:2.10+dfsg1-4
None known
fop
Debian:14
All versions, plus listed versions
1:2.10+dfsg-21:2.10+dfsg1-11:2.10+dfsg1-21:2.10+dfsg1-31:2.10+dfsg1-4
None known
xmlgraphics-commons
Debian:12
All versions, plus listed versions
2.10-12.10-22.10-32.11-12.8-2
None known
xmlgraphics-commons
Debian:13
All versions, plus listed versions
2.10-32.11-1
None known
xmlgraphics-commons
Debian:14
All versions, plus listed versions
2.10-32.11-1
None known
fop
Ubuntu:16.04:LTS
All versions, plus listed versions
1:1.1.dfsg2-1ubuntu11:2.1-2
None known
fop
Ubuntu:18.04:LTS
All versions, plus listed versions
1:2.1-7
None known
fop
Ubuntu:20.04:LTS
All versions, plus listed versions
1:2.3-21:2.4-2
None known
fop
Ubuntu:22.04:LTS
All versions, plus listed versions
1:2.5-31:2.6-11:2.6-2
None known
fop
Ubuntu:24.04:LTS
All versions, plus listed versions
1:2.8-21:2.8-3
None known
fop
Ubuntu:26.10
All versions, plus listed versions
1:2.10+dfsg-2
None known
fop
Ubuntu:26.04:LTS
All versions, plus listed versions
1:2.10+dfsg-2
None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesGitHub Advisories, OSV
referencesCVE List
referencesNVD
publishedEUVD, NVD
publishedEUVD
references, titleCVE List
aliases, cwes, references, titleGitHub Advisories
first indexedEUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-126627 is a vulnerability with no CVSS score yet in Apache Software Foundation Xml Graphics Fop, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. No source names a fixed version.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open