TemporaryFolder on unix-like systems does not limit access to created files

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

4.4 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS

• CVE-2020-15250: 1.70% estimated exploitation activity in the next 30 days; percentile 77.16 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Vulnerability The JUnit4 test rule TemporaryFolder contains a local information disclosure vulnerability. Example of vulnerable code: Impact On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. When analyzing the impact of this vulnerability, here are the important questions to ask: 1. Do the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder? - If yes, this vulnerability impacts you, but only if you also answer 'yes' to question 2. - If no, this vulnerability does not impact you. 2. Do the JUnit tests ever execute in an environment where the OS has other untrusted users. This may apply in CI/CD…

Published by the source

12 Oct 2020, 17:33 UTC

Last modified by the source

1 Feb 2023, 05:04 UTC

Source last checked

26 Oct 2026, 16:06 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-269g-pwp5-87pp

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2020-15250

Advisory: TemporaryFolder on unix-like systems does not limit access to created files
IDs: CVE-2020-15250, GHSA-269g-pwp5-87pp
Record: https://patchnext.com/advisories/cve-2020-15250 (revision 1, source checked 26 Oct 2026, 16:06 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 4.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: junit:junit 4.13.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven junit:junit: affected >= 4.7, < 4.13.1; fixed in 4.13.1

## Suggested inspection (read-only)
- Maven junit:junit: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on junit:junit.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-269g-pwp5-87pp (GitHub-reviewed advisory GHSA-269g-pwp5-87pp lists affected ranges: Maven junit:junit >=4.7 <4.13.1)

Commands are suggestions: review each one before running it.