Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.codelibs.fess:fess

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 1.2MavenPublished

    Fess has Insecure Temporary File Permissions

    CVE-2025-48382 · GHSA-g88v-2j67-9rmx

    Affected
    • Maven org.codelibs.fess:fess < 14.19.2
    Fixed in
    14.19.2· Vendor fix available
    Issue
    Fess (an open-source Enterprise Search Server) creates temporary files without restrictive permissions, which may allow local attackers to read sensitive information from these temporary files. Details The createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files. Impact This issue primarily affects environments where Fess is deployed in a shared or multi-user context. Typical single-user or isolated deployments have minimal or negligible practical impact. Workarounds Ensure local access to the environment running Fess is restricted to trusted users only. References - CVE-2022-24823: Netty temporary file permissions vulnerability

    Recommended action: Upgrade to 14.19.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Critical, CVSS 10.0MavenPublished

    XML External Entity (XXE) vulnerability in codelibs fess

    CVE-2018-1000822 · GHSA-77hp-pfxw-4w63

    Affected
    • Maven org.codelibs.fess:fess < 12.3.2
    Fixed in
    12.3.2· Vendor fix available
    Issue
    codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.

    Recommended action: Upgrade to 12.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →