{"id":"CVE-2021-28099","aliases":["EUVD-2021-0635","GHSA-9295-mhf3-v33m"],"status":"published","title":"Insecure temporary file in Netflix OSS Hollow","description":"In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00251,"percentile":0.16613,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-330","CWE-377"],"published":"2021-03-23T20:28:52Z","modified":"2026-06-17T03:45:48Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.netflix.hollow:hollow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.1.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.netflix.hollow:hollow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.1.0"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.1.0","2.1.1","2.10.0","2.11.0","2.11.1","2.12.0","2.14.0","2.14.1","2.15.0","2.15.1","2.15.2","2.16.0","2.16.1","2.16.3","2.16.4","2.16.5","2.16.6","2.16.7","2.17.1","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.10","2.6.11","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","3.0.0","3.0.1","3.0.2","3.1.0","3.2.0","3.3.0","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","4.0.0","4.0.1","4.0.2","4.0.3","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.2.3","4.3.0","4.4.0","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.7.0","4.7.1","4.7.10","4.7.11","4.7.12","4.7.13","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","4.7.8","4.7.9","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.9.0","4.9.1","4.9.3","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.1.0","5.1.1","5.1.2","5.1.3","5.2.0","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5","6.0.0","6.1.0"]}],"products":[{"vendor":"netflix","product":"hollow"}],"references":[{"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-001.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28099","tags":["advisory"]},{"url":"https://github.com/Netflix/hollow/issues/502","tags":["web"]},{"url":"https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-j83w-7qr9-wv86","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9295-mhf3-v33m"}],"sources":{"cve":[{"id":"CVE-2021-28099","description":"In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.","status":"published","published":"2021-03-23T20:28:52Z","modified":"2024-08-03T21:33:17.497Z","updated_at":"2026-11-02T14:33:09.175141Z"}],"euvd":[{"id":"EUVD-2021-0635","description":"In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.","status":"published","published":"2021-03-23T20:28:52Z","modified":"2024-08-03T21:33:17Z","updated_at":"2026-11-03T03:24:47.80549Z"}],"ghsa":[{"id":"GHSA-9295-mhf3-v33m","title":"Insecure temporary file in Netflix OSS Hollow","description":"\u003e ID: NFLX-2021-001\n\u003e Title: Local information disclosure in Hollow\n\u003e Release Date: 2021-03-23\n\u003e Credit: Security Researcher @JLLeitschuh\n\n# Overview\n\nSecurity researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.\n\n# Impact\n\nAn attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.\n\n# Description\n\nSince the `Files.exists(parent)` is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.\n\n# Workarounds and Fixes\n\nAvoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.","status":"published","published":"2021-03-29T18:25:26Z","modified":"2023-08-08T19:54:40Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:36:59.456342Z"}],"nvd":[{"id":"CVE-2021-28099","description":"In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.","status":"published","published":"2021-03-23T21:15:13.557Z","modified":"2026-06-17T03:45:48.64Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"GHSA-9295-mhf3-v33m","title":"Insecure temporary file in Netflix OSS Hollow","description":"\u003e ID: NFLX-2021-001\n\u003e Title: Local information disclosure in Hollow\n\u003e Release Date: 2021-03-23\n\u003e Credit: Security Researcher @JLLeitschuh\n\n# Overview\n\nSecurity researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.\n\n# Impact\n\nAn attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.\n\n# Description\n\nSince the `Files.exists(parent)` is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.\n\n# Workarounds and Fixes\n\nAvoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.","status":"published","published":"2021-03-29T18:25:26Z","modified":"2024-02-16T08:10:15.734375Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}