CVE-2020-8908
LowCVSS 3.3Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by com.google.common.io.Files.createTempDir(). By default, on Unix-like systems, the created directory is world-readable.
Risk Assessment
An attacker with local access to the system can read data stored in the temporary directory created by Guava. The risk affects Java applications using this method for temporary data storage.
Recommendation
Change how temporary directories are created: on Android use context.getCacheDir(), and in Java migrate to java.nio.file.Files.createTempDirectory() with 700 permissions or configure java.io.tmpdir to a location with appropriate permissions. The createTempDir() method is deprecated since version 30.0 and should not be used.
Related vulnerabilities
- CVE-2026-121260Critical
Ziroom ZHOME A0101 1.0.1.0 Build 202004151405 contains a flaw in the loadstring function of usr/lib/lua/luci/controller/api/zrUsb.lua (Lua Handler component). The manipulation causes code injection and can be exploited remotely. The exploit has been published and may be used; the vendor did not respond to the disclosure.
- CVE-2026-118527MediumActively exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
- CVE-2026-89292Critical
In Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0, an unauthenticated attacker could exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
- CVE-2026-4052Critical
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
- CVE-2026-13594Critical
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
- CVE-2026-120534Critical
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. Insufficient validation of form configuration parameters allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments.
- CVE-2026-120518Critical
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. The bpxp_image_field_update_on_user_activation() function calls unlink() on a path built from visitor-supplied signup metadata without realpath() resolution, containment check, or extension allow-list.
- CVE-2026-86596Critical
The s2Member plugin for WordPress in versions up to and including 260927 is vulnerable to Remote Code Execution via the 'item_name' parameter. Insufficient sanitization in strip_php_tags_deep() only strips literal '<?' sequences, and a post-interpolation placeholder cleanup reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template.
- CVE-2026-97718Critical
CVE-2026-97718 is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
- CVE-2026-116769Critical
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
Original NVD description (English source)
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS