Creation of temporary file in directory with insecure permissions in pytest - CVE-2025-71176

Vulnerability identifier: #VU123607

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L]

CVE-ID: CVE-2025-71176

CWE-ID: CWE-379

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to escalate privileges on the system.

The vulnerability exists due to pytest on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern. A local user can cause a denial of service or possibly gain privileges on the system.

pytest
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Python 3 Module
openSUSE Leap
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
watsonx Code Assistant On Prem
InfoSphere Optim Archive Viewer
python311-pytest

Install updates from vendor's website.

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.4
watsonx Code Assistant On Prem - update to 5.3.1
python311-pytest - update to 8.3.5-150400.3.15.1
InfoSphere Optim Archive Viewer - update to 11.7.0.14

• https://github.com/pytest-dev/pytest/issues/13669
• https://www.openwall.com/lists/oss-security/2026/01/21/5

• Creation of temporary file in directory with insecure permissions in pytest
• Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
• SUSE update for python-pytest
• IBM InfoSphere Optim Archive Viewer update for pytest
• IBM Watson Speech Services Cartridge update for pytest