Local data disclosure via permissive temporary files

Incorrect default permissions in JetBrains Kotlin before 1.4.21 allow local users to read temporary files and list temporary directories. The kotlin.io createTempFile and createTempDir functions use java.io.File creation in a shared default temporary location, producing files and directories with permissions broad enough for other system users. Exploitation requires another local account and an application that stores sensitive data through these APIs; the bounded consequence is disclosure of that temporary data and directory contents.