projectdiscovery/nuclei · error

could not create temp directory: %w

Error message

could not create temp directory: %w

What it means

Before writing the temporary secrets file, the code creates os.TempDir()/nuclei-secrets (mode 0700) with os.MkdirAll (cmd/nuclei/main.go:899); failure is wrapped as 'could not create temp directory'. Common causes: TMPDIR pointing at a missing or read-only location, permission denial on the parent, a stale nuclei-secrets directory owned by another user (it is 0700), or disk/inode exhaustion.

Source

Thrown at cmd/nuclei/main.go:899

	}

	var profile profileSecrets
	if err := yaml.Unmarshal(data, &profile); err != nil {
		return "", fmt.Errorf("could not parse profile YAML: %w", err)
	}

	if profile.Secrets == nil {
		return "", nil
	}

	secretsData, err := yaml.Marshal(profile.Secrets)
	if err != nil {
		return "", fmt.Errorf("could not marshal inline secrets: %w", err)
	}

	tempDir := filepath.Join(os.TempDir(), "nuclei-secrets")
	if err := os.MkdirAll(tempDir, 0700); err != nil {
		return "", fmt.Errorf("could not create temp directory: %w", err)
	}

	tempFile, err := os.CreateTemp(tempDir, "inline-secrets-*.yaml")
	if err != nil {
		return "", fmt.Errorf("could not create temp secrets file: %w", err)
	}
	defer func() {
		_ = tempFile.Close()
	}()

	if _, err := tempFile.Write(secretsData); err != nil {
		_ = tempFile.Close()
		_ = os.Remove(tempFile.Name())
		return "", fmt.Errorf("could not write to temp secrets file: %w", err)
	}

	options.SecretsFile = append(options.SecretsFile, tempFile.Name())
	return tempFile.Name(), nil

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Point TMPDIR at a writable directory: `TMPDIR=/var/tmp nuclei ...`
2. Remove a stale directory owned by another user: `sudo rm -rf /tmp/nuclei-secrets`
3. Verify /tmp is writable and has space/inodes (`df -h /tmp`)
4. Mount an ephemeral writable /tmp in containers

Example fix

# before (stale dir owned by root)
ls -ld /tmp/nuclei-secrets   # drwx------ root root

# after
sudo rm -rf /tmp/nuclei-secrets && nuclei -profile scan.yaml

dir := filepath.Join(os.TempDir(), "nuclei-secrets")
if err := os.MkdirAll(dir, 0o700); err != nil {
    // probe writability with a throwaway file
    return fmt.Errorf("temp dir %s unusable: %w", os.TempDir(), err)
}

if err := os.MkdirAll(tempDir, 0o700); err != nil {
    if errors.Is(err, fs.ErrPermission) {
        // likely stale 0700 dir owned by another user
        return fmt.Errorf("cannot create %s (owned by another user? set TMPDIR): %w", tempDir, err)
    }
    return err
}

When it happens

Trigger: TMPDIR env var set to a nonexistent/non-writable path; /tmp mounted read-only in hardened containers; a previous run under a different user leaving a 0700 directory you cannot enter; ENOSPC/EIO on the temp filesystem.

Common situations: CI containers with restricted /tmp or odd TMPDIR; multi-user hosts where root ran nuclei first; disk-full conditions on tmpfs.

Related errors

• could not read profile file: %w
• could not create temp secrets file: %w
• could not write to temp secrets file: %w
• prompt not found (read cap reached)
• include directive preprocessing is disabled

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/d0c10205aae752ac. Report an issue: GitHub.