Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

CVE-2023-2976

What is CVE-2023-2976?

A security flaw in Google Guava allows unauthorized access to files created in the default temporary directory on Unix and Android systems. This vulnerability, found in versions 1.0 to 31.1, poses a risk as files can be accessed by other users and applications. The issue has been resolved in version 32.0.0, but users are advised to upgrade to version 32.0.1 for optimal functionality and security, particularly since 32.0.0 may disrupt features on Windows systems.

References