{"id":"CVE-2026-126627","aliases":["DEBIAN-CVE-2026-126627","EUVD-2026-123361","GHSA-77r6-35jh-hcr9","UBUNTU-CVE-2026-126627"],"status":"published","title":"Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local users","description":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","epss":{"day":"2026-11-12","score":0.00206,"percentile":0.10836,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-378"],"published":"2026-11-11T11:23:17Z","modified":"2026-11-13T01:00:08Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-1","1:2.10+dfsg-1~exp0","1:2.10+dfsg-1~exp1","1:2.10+dfsg-2","1:2.10+dfsg1-1","1:2.10+dfsg1-2","1:2.10+dfsg1-3","1:2.10+dfsg1-4","1:2.8-2","1:2.8-3"]},{"source":"osv","ecosystem":"Debian:13","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2","1:2.10+dfsg1-1","1:2.10+dfsg1-2","1:2.10+dfsg1-3","1:2.10+dfsg1-4"]},{"source":"osv","ecosystem":"Debian:14","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2","1:2.10+dfsg1-1","1:2.10+dfsg1-2","1:2.10+dfsg1-3","1:2.10+dfsg1-4"]},{"source":"osv","ecosystem":"Debian:12","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10-1","2.10-2","2.10-3","2.11-1","2.8-2"]},{"source":"osv","ecosystem":"Debian:13","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10-3","2.11-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10-3","2.11-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.1.dfsg2-1ubuntu1","1:2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.1-7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3-2","1:2.4-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5-3","1:2.6-1","1:2.6-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.8-2","1:2.8-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2"]}],"products":[{"vendor":"apache software foundation","product":"apache xml graphics fop"}],"references":[{"url":"https://issues.apache.org/jira/browse/FOP-3284","tags":["issue-tracking","report"]},{"url":"https://lists.apache.org/thread.html/f8mys56y18wjmp1wzg4qmx6hhyjxgo0f","tags":["vendor-advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/11/15","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126627"},{"url":"https://github.com/advisories/GHSA-77r6-35jh-hcr9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-126627","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-126627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-126627","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-126627","title":"Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local users","description":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T11:23:17.03Z","modified":"2026-11-11T19:05:17.239Z","cwes":["CWE-378"],"updated_at":"2026-11-11T21:33:02.552103Z"}],"euvd":[{"id":"EUVD-2026-123361","description":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T11:23:17Z","modified":"2026-11-11T19:05:17Z","updated_at":"2026-11-11T14:29:04.585574Z"}],"ghsa":[{"id":"GHSA-77r6-35jh-hcr9","title":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.\n\n\n...","description":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T12:31:42Z","modified":"2026-11-11T21:34:00Z","cwes":["CWE-378"],"updated_at":"2026-11-11T21:36:29.153415Z"}],"nvd":[{"id":"CVE-2026-126627","description":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T12:19:51.03Z","modified":"2026-11-12T17:06:26.857Z","cwes":["CWE-378"],"updated_at":"2026-11-11T21:26:19.995556Z"}],"osv":[{"id":"DEBIAN-CVE-2026-126627","description":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.    This issue affects Apache XML Graphics FOP: through 2.11.    Users are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T12:19:51.03Z","modified":"2026-11-13T01:00:08.25707911Z","updated_at":"2026-11-13T01:23:59.672544Z"},{"id":"UBUNTU-CVE-2026-126627","description":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-12T00:00:00Z","modified":"2026-11-12T23:46:40.243803256Z","updated_at":"2026-11-13T00:19:56.632115Z"}]}}