The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directories (via the `-init` file) that the victim JVM will resolve first in its classpath. By strategically placing a malicious version of a commonly used library (e.g., `commons-io`) in a location that is included in the classpath before the legitimate version, an attacker can cause the JVM to load the malicious class during startup, thereby executing the attacker's code.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Wolfram Research |
|
No data.
No data.
References
History
Mon, 29 Jun 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wolfram Research
Wolfram Research cloud |
|
| Vendors & Products |
Wolfram Research
Wolfram Research cloud |
Fri, 26 Jun 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-20 CWE-937 |
Fri, 26 Jun 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 CWE-426 |
Fri, 26 Jun 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 CWE-426 |
|
| Metrics |
cvssV3_1
|
Fri, 26 Jun 2026 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directories (via the `-init` file) that the victim JVM will resolve first in its classpath. By strategically placing a malicious version of a commonly used library (e.g., `commons-io`) in a location that is included in the classpath before the legitimate version, an attacker can cause the JVM to load the malicious class during startup, thereby executing the attacker's code. | |
| Title | Unprotected temporary directories in Wolfram Cloud may result in privilege escalation | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: certcc
Published: 2026-06-26T15:39:41.353Z
Updated: 2026-06-26T17:40:10.720Z
Reserved: 2025-10-17T14:38:44.831Z
Link: CVE-2025-11919
Vulnrichment
Updated: 2026-06-26T15:49:25.791Z
NVD
No data.
Redhat
No data.