Vulnerability · Published Oct 12, 2026 · Assigned by GitHub_M

CVE-2026-49484Code for IBM i: Temporary files are visible to all users

Medium 5.1

In plain English

A medium-severity security flaw in vscode-ibmi from codefori. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 77.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.

Affected products (as reported)

Vendor	Product	Versions
codefori	vscode-ibmi	< 3.0.1

Weakness: CWE-377, CWE-459 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

References

https://github.com/codefori/vscode-ibmi/security/advisories/GHSA-9869-gm55-mqpq x_refsource_CONFIRM
https://github.com/codefori/vscode-ibmi/commit/6a13990a0f6c2fb4cf71ba8fbde1cef32c808b1e x_refsource_MISC