Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-29429

CVE-2021-29429MEDIUM

gradle gradle — Information disclosure through temporary directory permissions

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  N  N    5.5   .0048   40.3     —

AFFECTED
  Product  Versions  Fixed
  gradle   < 7.0 –   —

TIMELINE
  Mar 30  Reserved by GitHub_M
  Apr 12  Published (CNA: GitHub_M)
  Oct 8   EXPLOIT PUBLISHED — CVE-2021-29429 (gradle). Public exploit reference added.
  Oct 8   RESCORED — CVE-2021-29429 (gradle). CVSS 4 → 5.5 (NVD).

CWE-377 · CNA: GitHub_M · CVSS v3.1 · 2 references · NVD status: Modified

Description

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded into the system temporary directory first. Sensitive information contained in these files can be exposed to other local users on the same system. If you do not use the `TextResourceFactory` API, you are not vulnerable. As of Gradle 7.0, uses of the system temporary directory have been moved to the Gradle User Home directory. By default, this directory is restricted to the user running the build. As a workaround, set a more restrictive umask that removes read access to other users. When files are created in the system temporary directory, they will not be accessible to other users. If you are unable to change your system's umask, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
March 30, 2021	Reserved	Reserved by GitHub_M
April 12, 2021	Published	Published (CNA: GitHub_M)
October 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2021-29429 (gradle). Public exploit reference added.
October 8, 2026	RESCORED	RESCORED — CVE-2021-29429 (gradle). CVSS 4 → 5.5 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
gradle	gradle	—	< 7.0	—

Weaknesses

CWE-377

References (2)

https://docs.gradle.org/7.0/release-notes.html#security-advisories [Release Notes, Vendor Advisory]
https://github.com/gradle/gradle/security/advisories/GHSA-fp8h-qmr5-j4c8 [Exploit, Mitigation, Third Party Advisory]

Authoritative record: CVE-2021-29429 at cve.org

Vendors: gradle

Weaknesses: CWE-377

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-29429 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.