CVE-2026-49484 PUBLISHED

Code for IBM i: Temporary files are visible to all users

Assigner: GitHub_M
Reserved: 30.05.2026 Published: 12.10.2026 Updated: 12.10.2026

Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
CVSS Score: 5.1

Product Status

Vendor codefori
Product vscode-ibmi
Versions
  • Version < 3.0.1 is affected

References

Problem Types

  • CWE-377: Insecure Temporary File CWE
  • CWE-459: Incomplete Cleanup CWE