CVE-2026-49484: Code for IBM i: Temporary files are visible to all users

Q: Who can access the exposed temporary files?

Other local accounts can read the files when the system's shared /tmp directory is accessible to them. The exposure occurs after Object Browser downloads or edit-save operations leave content in that directory.

Q: What access does an attacker need to exploit this issue?

An attacker needs access to a local account that can read the shared /tmp directory. Exploitation also requires a user of the extension to perform an affected download or editing operation that creates temporary content.

Q: Are installations affected by default?

Exposure depends on whether /tmp is accessible to other local accounts. Systems that restrict other accounts from reading the relevant temporary files are not described as exposed by the advisory.

Q: How can I remediate the issue?

Upgrade Code for IBM i to version 3.0.1, which fixes the unreliable cleanup of Object Browser download and edit-save temporary content. If upgrading cannot happen immediately, restrict access to /tmp from other local accounts where possible and treat files created by affected operations as potentially exposed.

Q: How can I determine whether sensitive content may already have been exposed?

Review whether an affected version was used for Object Browser downloads or edit-save operations on a system where other local accounts could access /tmp. Any content handled through those operations may have remained readable in /tmp due to unreliable cleanup.

Published Oct 12, 2026

Updated

Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.

Affected Software

1 affected component

IBM Code for IBM i<3.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.1

Event History

Oct 12, 2026

CVE Published

via MITRE·09:37 PM

Data Sourced

via MITRE·09:37 PM

DescriptionWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can access the exposed temporary files?

Other local accounts can read the files when the system's shared /tmp directory is accessible to them. The exposure occurs after Object Browser downloads or edit-save operations leave content in that directory.

What access does an attacker need to exploit this issue?

An attacker needs access to a local account that can read the shared /tmp directory. Exploitation also requires a user of the extension to perform an affected download or editing operation that creates temporary content.

Are installations affected by default?

Exposure depends on whether /tmp is accessible to other local accounts. Systems that restrict other accounts from reading the relevant temporary files are not described as exposed by the advisory.

How can I remediate the issue?

Upgrade Code for IBM i to version 3.0.1, which fixes the unreliable cleanup of Object Browser download and edit-save temporary content. If upgrading cannot happen immediately, restrict access to /tmp from other local accounts where possible and treat files created by affected operations as potentially exposed.

How can I determine whether sensitive content may already have been exposed?

Review whether an affected version was used for Object Browser downloads or edit-save operations on a system where other local accounts could access /tmp. Any content handled through those operations may have remained readable in /tmp due to unreliable cleanup.

CVE-2026-49484: Code for IBM i: Temporary files are visible to all users

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can access the exposed temporary files?

What access does an attacker need to exploit this issue?

Are installations affected by default?

How can I remediate the issue?

How can I determine whether sensitive content may already have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can access the exposed temporary files?

What access does an attacker need to exploit this issue?

Are installations affected by default?

How can I remediate the issue?

How can I determine whether sensitive content may already have been exposed?