Local file disclosure or hijacking via temp-directory race

Insecure temporary-directory creation in ManyDesigns Portofino 5.3.2 allows local users to read or alter launcher files. The WarFileLauncher.createTempDir method creates a temporary file, deletes it, and calls mkdir without checking success, leaving a race and default directory permissions instead of atomically creating a private directory. A co-resident user on a shared Unix-like host can win the delete-and-mkdir race or read exposed contents, enabling disclosure or code execution with the service account's privileges.