Executive brief
The mktemp utility in uutils coreutils, a Rust-based alternative to standard GNU system tools, incorrectly handles empty environment variables when determining where to create temporary files. Instead of using the secure system temporary directory, it may create files in the user's current working directory. This could allow other users on the same system to access sensitive temporary data if the current directory has less restrictive security settings than the standard system temporary folder.
Technical details
The mktemp utility in uutils coreutils (uu_mktemp) treats an empty string in the TMPDIR environment variable as a valid path rather than falling back to /tmp. This results in an Insecure Temporary File vulnerability (CWE-377) where files are created in the current working directory (CWD). An attacker with local access could potentially read or manipulate these files if the CWD has more permissive permissions than /tmp. The issue was identified in audited commit 3a07ffc and is resolved in version 0.6.0 by treating an empty TMPDIR as unset.
Affected products
- uutils coreutils (uu_mktemp) < 0.6.0
Timeline
- 2026-01-29: other: Pull request submitted to fix the issue
- 2026-01-31: patched: Fix merged into main branch
- 2026-02-02: other: Version 0.6.0 released
- 2026-07-06: advisory: GitHub Advisory published
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-2w8r-9xj7-69j5
- https://github.com/uutils/coreutils/pull/10566
- https://github.com/uutils/coreutils/commit/eb25ec328b226d8fbbaa4058bf9187165bf06d51
- https://github.com/uutils/coreutils/releases/tag/0.6.0
- https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-2w8r-9xj7-69j5