CVE-2025-48382: Fess has Insecure Temporary File Permissions

May 27, 2025 (updated October 31, 2025)

Fess (an open-source Enterprise Search Server) creates temporary files without restrictive permissions, which may allow local attackers to read sensitive information from these temporary files.

References

github.com/advisories/GHSA-g88v-2j67-9rmx
github.com/codelibs/fess
github.com/codelibs/fess/commit/25b2009fea2a0f6ccd5aa8154aa54b536c08f6c4
github.com/codelibs/fess/security/advisories/GHSA-g88v-2j67-9rmx
nvd.nist.gov/vuln/detail/CVE-2025-48382

Code Behaviors & Features

Detect and mitigate CVE-2025-48382 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →