{"id":"CVE-2026-126627","kind":"vulnerability","aliases":["CVE-2026-126627"],"related":[],"title":"Apache FOP: temporary files created with insecure permissions, local users may read them","description":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","summary":"Apache FOP, a Java library that turns XML into PDF and other print formats, creates temporary files with insecure permissions. Another local user on the same machine could potentially read or tamper with those files.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-fop","java","package","xml-graphics"],"not_affected_if":["fop-2.12-or-later","single-user-host"],"how_to_check":"- Check the FOP version in your build file or dependency tree, for example `org.apache.xmlgraphics:fop` in `pom.xml` or `build.gradle`\n- Confirm whether the affected version is `2.11` or earlier","fix":"- Apache XML Graphics FOP: upgrade to `2.12`","status":"open","published_at":"2026-11-11T12:19:51+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","triaged_at":"2026-11-11T12:29:03+00:00","updated_at":"2026-11-11T12:29:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T12:29:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apache XML Graphics FOP: upgrade to `2.12`","reach":"local","title":"Apache FOP: temporary files created with insecure permissions, local users may read them","impact":"medium","summary":"Apache FOP, a Java library that turns XML into PDF and other print formats, creates temporary files with insecure permissions. Another local user on the same machine could potentially read or tamper with those files.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-fop","xml-graphics"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"local users read or alter temporary files created by FOP","analyst_note":"Confirm the exact file paths, permissions and preconditions from the Apache advisory or NVD entry for CVE-2026-126627.","how_to_check":"- Check the FOP version in your build file or dependency tree, for example `org.apache.xmlgraphics:fop` in `pom.xml` or `build.gradle`\n- Confirm whether the affected version is `2.11` or earlier","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fop-2.12-or-later","single-user-host"],"who_is_affected":"Applications that embed Apache FOP 2.11 or earlier and run it on shared multi-user machines or servers where other local users can access the temporary directory. Systems that only run FOP in a single-user context or do not use FOP are unlikely to be exposed. The sources do not say which specific temporary files or conditions are required.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000744,"input_tokens":4533,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126627':15A,18A '-2026':14A,17A '2.11':83C '2.12':91C 'affect':77C 'anoth':47B 'apach':1A,20B,27B,71C,78C 'apache-fop':19B 'could':54B 'creat':5A,41B 'creation':62C 'cve':13A,16A 'file':4A,43B,61B,65C 'fix':93C 'fop':2A,21B,28B,74C,81C 'format':40B 'graphic':26B,73C,80C 'insecur':7A,45B,67C 'issu':76C,95C 'java':22B,30B 'librari':31B 'local':9A,48B 'machin':53B 'may':11A 'packag':23B 'pdf':36B 'permiss':8A,46B,68C 'potenti':55B 'print':39B 'read':12A,56B 'recommend':86C 'tamper':58B 'temporari':3A,42B,64C 'turn':33B 'upgrad':88C 'user':10A,49B,84C 'version':90C 'vulner':69C 'xml':25B,34B,72C,79C 'xml-graphic':24B","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Apache FOP 2.11 or earlier and run it on shared multi-user machines or servers where other local users can access the temporary directory. Systems that only run FOP in a single-user context or do not use FOP are unlikely to be exposed. The sources do not say which specific temporary files or conditions are required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachefop","java","package","unknown","xmlgraphics"],"campaign_type":null,"search_a":"'-126627':15A,18A '-2026':14A,17A 'apach':1A 'creat':5A 'cve':13A,16A 'file':4A 'fop':2A 'insecur':7A 'local':9A 'may':11A 'permiss':8A 'read':12A 'temporari':3A 'user':10A","search_b":"'anoth':47B 'apach':20B,27B 'apache-fop':19B 'could':54B 'creat':41B 'file':43B,61B 'fop':21B,28B 'format':40B 'graphic':26B 'insecur':45B 'java':22B,30B 'librari':31B 'local':48B 'machin':53B 'packag':23B 'pdf':36B 'permiss':46B 'potenti':55B 'print':39B 'read':56B 'tamper':58B 'temporari':42B 'turn':33B 'user':49B 'xml':25B,34B 'xml-graphic':24B","search_c":"'2.11':83C '2.12':91C 'affect':77C 'apach':71C,78C 'creation':62C 'file':65C 'fix':93C 'fop':74C,81C 'graphic':73C,80C 'insecur':67C 'issu':76C,95C 'permiss':68C 'recommend':86C 'temporari':64C 'upgrad':88C 'user':84C 'version':90C 'vulner':69C 'xml':72C,79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126627","severity":null,"published_at":"2026-11-11T12:19:51+00:00","modified_at":"2026-11-11T12:19:51+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","fetched_at":"2026-11-11T12:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}