By weakness (CWE)

CWE-377: related vulnerabilities

CVEs classified under CWE-377. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

6 published vulnerabilities

• CVE-2026-49134HIGH 7.1

  CodexBar versions before 0.32.0 contain a local privilege escalation flaw in the CLI installer. An attacker with access to the same system can intercept and modify the installer's temporary files during the installation process, tricking the system into running malicious commands with root-level privileges. This requires the attacker to be on the same machine and to time their interference with an active installation, but once successful, grants complete system control.

• CVE-2026-49135HIGH 7.1

  CodexBar versions before 0.32.0 have a serious flaw in how they handle temporary files during the app release and notarization process. An attacker with access to the same machine can steal the App Store Connect API credentials or sabotage the build artifacts before they're submitted to Apple. The vulnerability exists because CodexBar writes sensitive files to predictable, fixed locations that any local user can read or manipulate.

• CVE-2026-45384MEDIUM 6.1

  bit7z is a C++ library used by applications to handle file compression and extraction. Before version 4.0.12, the library had a flaw in how it created temporary files when updating archives. An attacker with local access could exploit a predictable temporary file location to create a symbolic link that tricks the library into overwriting arbitrary files on the system. This is a classic symlink-attack vulnerability affecting local privilege escalation or data integrity scenarios.

• CVE-2026-46406MEDIUM 6.1

  Claude Code versions 2.1.59 through 2.1.128 had a local file handling vulnerability in the /copy command that could leak sensitive information or allow file manipulation. When the command executed, it wrote responses to a predictable location (/tmp/claude/response.md) with insufficient protections. Any user on the system could read files written there, potentially exposing secrets or credentials. Additionally, an attacker could plant a symlink at that location to trick the tool into overwriting arbitrary files with command output. This vulnerability requires local system access and relies on a privileged user running the /copy command, limiting its scope but creating real risk in multi-user or containerized environments.

• CVE-2026-41001MEDIUM 5.3

  Spring Boot applications using embedded Artemis message brokers face a local privilege-escalation risk when no explicit data directory is configured. The affected versions default to a predictable, fixed path that an attacker with local system access can exploit before the application starts—either by pre-creating the directory or installing a symlink. This allows the attacker to read, modify, or disrupt the message broker's data, potentially compromising application integrity and confidentiality.

• CVE-2026-41991MEDIUM 4.7

  GNU gzip's gzexe utility has a flaw in how it creates temporary files when the mktemp utility is unavailable. Instead of using a secure method, it generates predictable temporary filenames based on the process ID (PID) alone. A local attacker can exploit this by creating a symbolic link at the predicted filename pointing to any file the victim can write to. When gzexe runs and follows that symlink, it overwrites the target file—giving an attacker a way to corrupt or modify files belonging to the user running gzexe.