CWE-377: Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
How it's found
Insecure Temporary File describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
Consequences
- Read Files or Directories, Modify Files or Directories
How TurboPentest tests for this (white-box)
This weakness (Insecure Temporary File) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 1 rule for it, flagging the issue directly in your source code as part of the pentest.
Frequently asked questions
What is CWE-377?
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
How do you find Insecure Temporary File?
Insecure Temporary File describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
What is the impact of CWE-377?
Read Files or Directories, Modify Files or Directories
Does TurboPentest test for Insecure Temporary File?
This weakness (Insecure Temporary File) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 1 rule for it, flagging the issue directly in your source code as part of the pentest.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest