Faktory, a language‑agnostic background job server, contains an insecure temporary file flaw. The embedded Redis bootstrapper writes its startup configuration to a fixed, world‑writable path /tmp/redis.conf only if that file does not already exist. Because the path is predictable and world‑writable, a local unprivileged user can pre‑create a file containing arbitrary Redis directives. Faktory then loads this file verbatim, overriding only a handful of options and leaving others such as bind, protected‑mode, requirepass, and loadmodule untouched. This allows an attacker to expose the job queue over an unauthenticated network port, and if the systemd unit runs Faktory as root, the attacker can also inject a loadmodule that executes arbitrary native code, resulting in remote code execution with root privileges. The weakness is a classic case of insecure temporary file usage, CWE‑377.

All Faktory releases prior to version 1.10.0 are affected. The vulnerability applies to Contribsys’s Faktory product when it is deployed via the bundled systemd unit that starts Faktory and its child Redis server as the root user. The exposed configuration path is /tmp/redis.conf. No additional sub‑version information is provided beyond the boundary of 1.10.0.

The CVSS score of 7.3 indicates a high‑severity local privilege escalation that can lead to remote code execution when root privileges are obtained. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user creating the predictable temporary file before Faktory starts. Once Faktory runs as root, the loaded Redis configuration can instruct the server to load a malicious module, giving the attacker root‑level code execution. The risk is significant for environments where Faktory runs as root and /tmp remains world‑writable, enabling any local user to perform the hijack.