Executive brief
A vulnerability exists in the Rust-based 'mktemp' utility, which is used to create secure temporary files. When a specific system setting (the TMPDIR environment variable) is empty, the tool incorrectly creates files in the user's current folder instead of a secure system directory. This could allow other users on the same system to view or access sensitive temporary data if the current folder has weaker security settings than the standard temporary directory.
Technical details
The mktemp utility in uutils coreutils (Rust implementation) fails to properly validate an empty TMPDIR environment variable. While the standard GNU implementation falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path, resulting in temporary file creation in the current working directory (CWD). This constitutes an insecure temporary file vulnerability (CWE-377). A local attacker could potentially access sensitive information if the CWD has more permissive permissions than the intended secure temporary directory. The issue is resolved in version 0.6.0 by treating an empty TMPDIR as unset.
Affected products
- uutils coreutils (Rust) < 0.6.0
Timeline
- 2026-01-31: patched: Fix merged into main branch via PR #10566
- 2026-02-02: advisory: Release 0.6.0 published
- 2026-04-22: disclosed: Initial advisory publication
- 2026-07-06: other: Advisory withdrawn as duplicate of GHSA-2w8r-9xj7-69j5