description: In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.
problem types: Local Information Disclosure
affected:
{
product: Netflix OSS Hollow
vendor: n/a
versions:
status: affected, version: All versions
}