Insecure Temporary File in HuTool

HIGH 7.1CVE-2023-33695 · GHSA-7mcw-xmx3-7p8m · Published 13/06/2023 · updated 17/06/2026

In short

CVE-2023-33695 is a HIGH (CVSS 7.1) vulnerability affecting cn.hutool:hutool-core, hutool (hutool).
Chance of exploitation in the next 30 days (EPSS): 0.24%, higher than 15.6% of all vulnerabilities.
Fix: update to 5.8.19 or later.

Package	Affected versions	Patched versions
cn.hutool:hutool-core Maven	`< 5.8.19`	`5.8.19`
hutool hutool	`≤ 5.8.17`	No fix yet

Description

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.

NVD description

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.

References

nvd.nist.gov/vuln/detail/CVE-2023-33695 · ADVISORY
dromara/hutool · WEB
dromara/hutool commit c33550f · WEB
dromara/hutool · PACKAGE

More vulnerabilities in cn.hutool:hutool-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cn.hutool:hutool-core

Maven

< 5.8.19

5.8.19

hutool

≤ 5.8.17

No fix yet

Description

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.

NVD description

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.

More vulnerabilities in cn.hutool:hutool-core

See all →