CVE-2021-21430: Insecure Permissions in auto-generated Java, Scala code
Summary
CVE-2021-21430: Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code. Affects org.openapitools:openapi-generator versions < 5.1.0. Fixed in 5.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The openapi-generator package is a tool that generates API client libraries, server stubs, and documentation from an OpenAPI Specification. It supports multiple programming languages, including Java and Scala. The vulnerability affects the generated code in these languages that deals with uploading or downloading binary data through API endpoints. The code uses the JDK method File.createTempFile, which creates temporary files with insecure permissions, leaving application and system data vulnerable to exposure.
Vulnerability Detail
The vulnerability arises from the use of File.createTempFile, which creates temporary files with default permissions (-rw-r--r-- for files and drwxr-xr-x for directories) on Unix-like systems. This means that any user on the system can read the contents of these files. Auto-generated clients that download files, such as PDFs, will first save them to insecure temporary files. This can lead to unauthorized access to sensitive data. The vulnerability has a CVSS score of 6.2, indicating a moderate severity.
How To Fix
Latest published version: 7.26.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround is to manually modify the generated code to use the JDK method Files.createTempFile instead of File.createTempFile. This method allows specifying secure file permissions. The following code snippet demonstrates the modification for the okhttp-gson library:
// Before
File tempFile = File.createTempFile(prefix, suffix);
// After
File tempFile = Files.createTempFile(prefix, suffix).toFile();
Conclusion
The vulnerability in the openapi-generator package allows for the creation of temporary files with insecure permissions, potentially exposing sensitive data. Users should update to version 5.1.0 or later to fix the vulnerability. If immediate update is not possible, manually modifying the generated code to use Files.createTempFile can serve as a workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.openapitools:openapi-generator →
FAQ
The vulnerability allows any user on the system to read the contents of temporary files created by the auto-generated code. This can lead to unauthorized access to sensitive data.
Versions prior to 5.1.0 of the openapi-generator package are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory. However, it is recommended to apply the fix as soon as possible to mitigate the risk.
Yes, the CVSS score for this vulnerability is 6.2, indicating a moderate severity.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.openapitools:openapi-generator.
