CVE-2026-49135
CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.2
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.13%
- CWE
- CWE-377, CWE-59
- Published
- 2026-06-01
- Last modified
- 2026-07-14
Affected products
- steipete CodexBar
Weakness type
Related vulnerabilities
- CVE-2026-40635 — Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File...
- CVE-2026-63404 — Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)
- CVE-2025-14602 — Weak File Name Generation in vsDesk
- CVE-2026-55086 — Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
- CVE-2026-75920 — phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP
- CVE-2026-53759 — linuxfabrik-lib: Insecure creation of SQLite databases
- CVE-2026-73584 — Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling
- CVE-2026-73585 — Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack