Read the docs
TI-2021-04528 Aliases CVE-2021-21430GHSA-cqxr-xf2w-943w

Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code

Priority LOW 28CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269, CWE-668 and the CVSS impact.

Summary

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. Affected generators: `java` (jersey2, okhttp-gson (default library)), `scala-finch`. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

Why it matters now

EPSS 0.00404 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed openapi-generator (OpenAPITools): 5.1.0org.openapitools:openapi-generator (Maven): 5.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenAPIToolsopenapi-generatorbefore 5.1.05.1.0Patch availableCNA
—org.openapitools:openapi-generator (Maven)before 5.1.05.1.0Patch availableGHSA-cqxr-xf2w-943w
  • openapi-generator VendorOpenAPITools Affected before 5.1.0 Fixed in 5.1.0 Patch available CNA
  • org.openapitools:openapi-generator (Maven) Vendor— Affected before 5.1.0 Fixed in 5.1.0 Patch available GHSA-cqxr-xf2w-943w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openapi-generator:openapi_generator:*:*:*:*:*:*:*:*before 5.1.1VulnerableOpenAPITools
  • cpe:2.3:a:openapi-generator:openapi_generator:*:*:*:*:*:*:*:* Versions before 5.1.1 Vulnerable ·OpenAPITools

Remediation

  • Fix · CNA openapi-generator (OpenAPITools) Fixed in 5.1.0
  • Fix · GHSA-cqxr-xf2w-943w org.openapitools:openapi-generator (Maven) Fixed in 5.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21430
  2. 2026-10-03 Alias added: GHSA-cqxr-xf2w-943w

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2023-11951 openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery… CVSS 3.1CRITICAL 9.1
  • TI-2021-04526 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator CVSS 3.1CRITICAL 9.3
  • TI-2019-08521 OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in… CVSS 3.0HIGH 8.1
  • TI-2021-04527 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin CVSS 3.1MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences