Vulnerability in Codelibs Fess
CVE-2025-48382
Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to po…
EPSS: 0.001 (25.0th percentile) — read the EPSS interpretation.
Affected products
- Codelibs Fess — versions < 14.19.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/codelibs/fess/security/advisories/GHSA-g88v-2j67-9rmx (x_refsource_CONFIRM)
- https://github.com/codelibs/fess/commit/25b2009fea2a0f6ccd5aa8154aa54b536c08f6c4 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-48382?
- CVE-2025-48382 is a vulnerability in Codelibs Fess, classified under Incorrect Permission Assignment for Critical Resource. Published 2025-05-27.
- Is CVE-2025-48382 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.