---
id: "CVE-2026-126627"
page: "https://infrastack.ai/live/CVE-2026-126627"
kind: "vulnerability"
aliases: ["CVE-2026-126627"]
title: "Apache FOP: temporary files created with insecure permissions, local users may read them"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-fop", "java", "package", "xml-graphics"]
not_affected_if: ["fop-2.12-or-later", "single-user-host"]
published_at: "2026-11-11T12:19:51+00:00"
first_seen_at: "2026-11-11T12:27:12+00:00"
updated_at: "2026-11-11T12:29:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126627", "first_seen_at": "2026-11-11T12:27:12+00:00"}]
exploit_sources: []
---

# Apache FOP: temporary files created with insecure permissions, local users may read them

Link for people: https://infrastack.ai/live/CVE-2026-126627 (this .md is for agents)

Apache FOP, a Java library that turns XML into PDF and other print formats, creates temporary files with insecure permissions. Another local user on the same machine could potentially read or tamper with those files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FOP version in your build file or dependency tree, for example `org.apache.xmlgraphics:fop` in `pom.xml` or `build.gradle`
- Confirm whether the affected version is `2.11` or earlier

## Fix

- Apache XML Graphics FOP: upgrade to `2.12`

## Timeline

- 2026-11-11T12:27:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126627

## From the sources

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.



This issue affects Apache XML Graphics FOP: through 2.11.



Users are recommended to upgrade to version 2.12, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_