DEBIAN-CVE-2026-126627: Debian/fop vulnerability
Published Nov 11, 2026
·Updated
Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
Affected Software
6 affected components
debian/fop*
debian/fop*
debian/fop*
debian/xmlgraphics-commons*
debian/xmlgraphics-commons*
debian/xmlgraphics-commons*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache XML Graphics FOPto a version that resolves this vulnerability.Fixed in 2.12
Event History
Nov 11, 2026
CVE Published
via OSV·12:19 PM
Data Sourced
via OSV·12:19 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which versions should be treated as vulnerable?
Apache XML Graphics FOP versions through 2.11 are affected. Upgrading to version 2.12 addresses the issue.
2
Are Debian packages other than fop identified in the affected software list?
Yes. The affected software list includes both debian/fop and debian/xmlgraphics-commons.