CVE Catalog
CVE-2023-33251
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk0.15%
5th percentile - higher than 5% of all known CVEs
Summary
Versions of Akka HTTP before 10.5.2 have a problem with the permissions of temporary files created during file uploads. These files have weak permissions, allowing other users to read them on Linux and UNIX systems.
Risk Assessment
Organizations may be exposed to unauthorized access to uploaded files, potentially leading to data leaks or breaches of user privacy.
Recommendation
It is recommended to upgrade Akka HTTP to version 10.5.2 or later to improve the security of temporary files.
Original NVD description (English source)
When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946.