CVE-2021-21428

CRITICAL

openapi-generator < 5.1.0 - Insecure Temporary File Permissions

Title source: llm

Description

Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_confirm

https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-23x4-m842-fmwf

Patch, Third Party Advisory x_refsource_misc

https://github.com/OpenAPITools/openapi-generator/pull/8788

Scores

CVSS v3 9.3

EPSS 0.0035

EPSS Percentile 26.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-269 CWE-668

Status published

Products (2)

openapi-generator/openapi_generator < 5.1.0

org.openapitools/openapi-generator-online 0 - 5.1.0Maven

Published May 10, 2021

Tracked Since Feb 18, 2026