{"id":"CVE-2026-120778","kind":"vulnerability","aliases":["CVE-2026-120778"],"related":[],"title":".NET Aspire: temp file in insecure directory lets local users gain privileges","description":"Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.","summary":"Microsoft rates this high (CVSS 7.3, local, needs user interaction): .NET Aspire creates a temporary file in a directory with insecure permissions, so a local low-privileged user may escalate privileges. Rapid7 lists the component as Aspire.Cli. Affected versions, the exact directory and the fix are not published in any source I could read.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aspire","aspire-cli","dotnet","linux","local-privilege-escalation","runtime","windows"],"not_affected_if":["single-user-machine"],"how_to_check":"Unknown: no affected version range published yet. Check whether the Aspire CLI (Aspire.Cli, 'aspire --version') is installed on shared multi-user machines, and watch the dotnet/aspire (microsoft/aspire) security advisories and MSRC for the fixed release.","fix":null,"status":"open","published_at":"2026-11-10T19:20:26+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","triaged_at":"2026-11-10T19:47:39+00:00","updated_at":"2026-11-10T22:04:39+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-10T19:47:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":".NET Aspire: temp file in insecure directory lets local users gain privileges","impact":"high","summary":"A temporary file is created in a directory with insecure permissions in .NET Aspire. An authorized local attacker can use this to elevate privileges on the machine.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["dotnet","aspire","windows","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated privileges on the machine","analyst_note":"Check the NVD entry and the .NET Aspire GitHub security advisory for affected versions, the exact temp directory, and the fixed release.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-machine"],"who_is_affected":"Affects machines where .NET Aspire runs and where more than one local account can write to the temporary directory it uses. The sources do not name the exact directory or the affected versions. Teams that only run Aspire on single-user machines or in isolated CI runners are likely lower risk, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4497,"output_tokens":444,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the .NET Aspire GitHub security advisory for affected versions, the exact temp directory, and the fixed release.","search":"'-120778':15A,18A '-2026':14A,17A '7.3':36B 'affect':69B 'allow':98C 'aspir':2A,19B,21B,42B,97C 'aspire-c':20B 'aspire.cli':68B 'attack':101C 'author':100C 'cli':22B 'compon':66B 'could':84B 'creat':43B 'creation':86C 'cve':13A,16A 'cvss':35B 'directori':7A,49B,73B,91C 'dotnet':23B 'elev':103C 'escal':28B,61B 'exact':72B 'file':4A,46B,89C 'fix':76B 'gain':11A 'high':34B 'insecur':6A,51B,93C 'interact':40B 'let':8A 'linux':24B 'list':64B 'local':9A,26B,37B,55B,105C 'local-privilege-escal':25B 'low':57B 'low-privileg':56B 'may':60B 'microsoft':31B 'need':38B 'net':1A,41B,96C 'permiss':52B,94C 'privileg':12A,27B,58B,62B,104C 'publish':79B 'rapid7':63B 'rate':32B 'read':85B 'runtim':29B 'sourc':82B 'temp':3A 'temporari':45B,88C 'user':10A,39B,59B 'version':70B 'window':30B","nicknames":[],"mitigations":[],"who_affected":"Affects machines where .NET Aspire runs and where more than one local account can write to the temporary directory it uses. The sources do not name the exact directory or the affected versions. Teams that only run Aspire on single-user machines or in isolated CI runners are likely lower risk, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspire","aspirecli","dotnet","high","linux","localprivilegeescalation","runtime","windows"],"campaign_type":null,"search_a":"'-120778':15A,18A '-2026':14A,17A 'aspir':2A 'cve':13A,16A 'directori':7A 'file':4A 'gain':11A 'insecur':6A 'let':8A 'local':9A 'net':1A 'privileg':12A 'temp':3A 'user':10A","search_b":"'7.3':36B 'affect':69B 'aspir':19B,21B,42B 'aspire-c':20B 'aspire.cli':68B 'cli':22B 'compon':66B 'could':84B 'creat':43B 'cvss':35B 'directori':49B,73B 'dotnet':23B 'escal':28B,61B 'exact':72B 'file':46B 'fix':76B 'high':34B 'insecur':51B 'interact':40B 'linux':24B 'list':64B 'local':26B,37B,55B 'local-privilege-escal':25B 'low':57B 'low-privileg':56B 'may':60B 'microsoft':31B 'need':38B 'net':41B 'permiss':52B 'privileg':27B,58B,62B 'publish':79B 'rapid7':63B 'rate':32B 'read':85B 'runtim':29B 'sourc':82B 'temporari':45B 'user':39B,59B 'version':70B 'window':30B","search_c":"'allow':98C 'aspir':97C 'attack':101C 'author':100C 'creation':86C 'directori':91C 'elev':103C 'file':89C 'insecur':93C 'local':105C 'net':96C 'permiss':94C 'privileg':104C 'temporari':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120778","severity":null,"published_at":"2026-11-10T19:20:26+00:00","modified_at":"2026-11-10T19:20:27+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","fetched_at":"2026-11-10T19:25:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120778:2918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120778","severity":null,"published_at":"2026-11-10T22:04:39+00:00","modified_at":"2026-11-10T22:04:39+00:00","first_seen_at":"2026-11-10T22:04:39+00:00","fetched_at":"2026-11-10T22:04:39+00:00","note":"Only NVD/Rapid7 text found (Rapid7 title names component Aspire.Cli). No Microsoft/GitHub advisory with versions, temp dir or fix is published yet; MSRC and GitHub advisory pages returned nothing. Nothing verified. Revisit when the advisory appears.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-120778"]}],"documents":[{"id":119380,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120778","title":"NVD CVE-2026-120778","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}