CVE-2026-126627 · Package
NO FIX YET · SEE WHAT TO DO
Apache FOP, a Java library that turns XML into PDF and other print formats, creates temporary files with insecure permissions. Another local user on the same machine could potentially read or tamper with those files.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that embed Apache FOP 2.11 or earlier and run it on shared multi-user machines or servers where other local users can access the temporary directory. Systems that only run FOP in a single-user context or do not use FOP are unlikely to be exposed. The sources do not say which specific temporary files or conditions are required.
Not affected if fop-2.12-or-later, single-user-host
Who cares apache-fop, java, xml-graphics
org.apache.xmlgraphics:fop in pom.xml or build.gradle2.11 or earlier2.12Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.
This issue affects Apache XML Graphics FOP: through 2.11.
Users are recommended to upgrade to version 2.12, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.