{"record":{"id":"d0c10205aae752ac","repo":"projectdiscovery/nuclei","slug":"could-not-create-temp-directory-w","errorCode":null,"errorMessage":"could not create temp directory: %w","messagePattern":"could not create temp directory: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nuclei/main.go","lineNumber":899,"sourceCode":"\t}\n\n\tvar profile profileSecrets\n\tif err := yaml.Unmarshal(data, &profile); err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not parse profile YAML: %w\", err)\n\t}\n\n\tif profile.Secrets == nil {\n\t\treturn \"\", nil\n\t}\n\n\tsecretsData, err := yaml.Marshal(profile.Secrets)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not marshal inline secrets: %w\", err)\n\t}\n\n\ttempDir := filepath.Join(os.TempDir(), \"nuclei-secrets\")\n\tif err := os.MkdirAll(tempDir, 0700); err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not create temp directory: %w\", err)\n\t}\n\n\ttempFile, err := os.CreateTemp(tempDir, \"inline-secrets-*.yaml\")\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not create temp secrets file: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = tempFile.Close()\n\t}()\n\n\tif _, err := tempFile.Write(secretsData); err != nil {\n\t\t_ = tempFile.Close()\n\t\t_ = os.Remove(tempFile.Name())\n\t\treturn \"\", fmt.Errorf(\"could not write to temp secrets file: %w\", err)\n\t}\n\n\toptions.SecretsFile = append(options.SecretsFile, tempFile.Name())\n\treturn tempFile.Name(), nil","sourceCodeStart":881,"sourceCodeEnd":917,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/cmd/nuclei/main.go#L881-L917","documentation":"Before writing the temporary secrets file, the code creates os.TempDir()/nuclei-secrets (mode 0700) with os.MkdirAll (cmd/nuclei/main.go:899); failure is wrapped as 'could not create temp directory'. Common causes: TMPDIR pointing at a missing or read-only location, permission denial on the parent, a stale nuclei-secrets directory owned by another user (it is 0700), or disk/inode exhaustion.","triggerScenarios":"TMPDIR env var set to a nonexistent/non-writable path; /tmp mounted read-only in hardened containers; a previous run under a different user leaving a 0700 directory you cannot enter; ENOSPC/EIO on the temp filesystem.","commonSituations":"CI containers with restricted /tmp or odd TMPDIR; multi-user hosts where root ran nuclei first; disk-full conditions on tmpfs.","solutions":["Point TMPDIR at a writable directory: `TMPDIR=/var/tmp nuclei ...`","Remove a stale directory owned by another user: `sudo rm -rf /tmp/nuclei-secrets`","Verify /tmp is writable and has space/inodes (`df -h /tmp`)","Mount an ephemeral writable /tmp in containers"],"exampleFix":"# before (stale dir owned by root)\nls -ld /tmp/nuclei-secrets   # drwx------ root root\n\n# after\nsudo rm -rf /tmp/nuclei-secrets && nuclei -profile scan.yaml","handlingStrategy":"validation","validationCode":"dir := filepath.Join(os.TempDir(), \"nuclei-secrets\")\nif err := os.MkdirAll(dir, 0o700); err != nil {\n    // probe writability with a throwaway file\n    return fmt.Errorf(\"temp dir %s unusable: %w\", os.TempDir(), err)\n}","typeGuard":null,"tryCatchPattern":"if err := os.MkdirAll(tempDir, 0o700); err != nil {\n    if errors.Is(err, fs.ErrPermission) {\n        // likely stale 0700 dir owned by another user\n        return fmt.Errorf(\"cannot create %s (owned by another user? set TMPDIR): %w\", tempDir, err)\n    }\n    return err\n}","preventionTips":["Set TMPDIR explicitly to a private writable directory in CI/containers","On shared hosts, clean /tmp/nuclei-secrets when switching users","Monitor free space/inodes on the temp filesystem"],"tags":["go","nuclei","filesystem","configuration","tmpdir","permissions"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}