Temp directory permission issue in Guava

Description

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Scores

EPSS (exploitation in 30 days)

0.92% · top 39% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.3.

Weakness

• CWE-378: Creation of Temporary File With Insecure Permissions (opens in a new tab)All about CWE-378 and its CVEs
• CWE-732 (opens in a new tab)All about CWE-732 and its CVEs

Affected products

• Google LLC · Guava

  • affected 1.0 – < 32.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavencom.google.guava:guavaGHSA-5mg8-w23w-74h3 (opens in a new tab)

References (43)

• https://github.com/google/guava/issues/4011 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415 (opens in a new tab)x_refsource_MISCx_transferred
• [ws-commits] 20210104 [ws-wss4j] branch master updated: Updating Guava to 30.1 due to CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [ws-commits] 20210104 [ws-wss4j] branch 2_3_x-fixes updated: Updating Guava to 30.1 due to CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cxf-commits] 20210104 [cxf] 03/04: Updating Guava to 30.1 due to CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cxf-commits] 20210104 [cxf] 02/02: Updating Guava to 30.1 due to CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3%40%3Ctorque-dev.db.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [maven-issues] 20210122 [GitHub] [maven-indexer] akurtakov opened a new pull request #75: Remove guava dependency from indexer-core (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [db-torque-dev] 20210127 Re: Items for our (delayed) quarterly report to the board? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [db-torque-dev] 20210128 Antwort: Re: Items for our (delayed) quarterly report to the board? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari opened a new pull request #10149: Upgrade jclouds to 2.3.0 to fix security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [myfaces-dev] 20210506 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #817: build: CVE fix (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [arrow-github] 20210610 [GitHub] [arrow] projjal opened a new pull request #10501: ARROW-13032: Update guava version (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuApr2021.html (opens in a new tab)x_refsource_MISCx_transferred
• [drill-dev] 20210618 [GitHub] [drill] ssainz edited a comment on issue #2260: CVE-2020-8908 in Guava v.28.2-jre, should upgrade to v.30.1.1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [drill-dev] 20210618 [GitHub] [drill] ssainz commented on issue #2260: CVE-2020-8908 in Guava v.28.2-jre, should upgrade to v.30.1.1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [drill-dev] 20210618 [GitHub] [drill] cgivre commented on issue #2260: CVE-2020-8908 in Guava v.28.2-jre, should upgrade to v.30.1.1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [drill-dev] 20210619 [GitHub] [drill] luocooong commented on issue #2260: CVE-2020-8908 in Guava v.28.2-jre, should upgrade to v.30.1.1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com//security-alerts/cpujul2021.html (opens in a new tab)x_refsource_MISCx_transferred
• [hadoop-yarn-issues] 20211018 [jira] [Updated] (YARN-10980) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-yarn-dev] 20211018 [jira] [Created] (YARN-10980) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20211018 [GitHub] [hadoop] lujiefsi opened a new pull request #3561: Yarn 10980 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-yarn-issues] 20211018 [jira] [Created] (YARN-10980) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-yarn-dev] 20211018 [jira] [Resolved] (YARN-10980) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-dev] 20211018 [jira] [Created] (HIVE-25617) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20211018 [GitHub] [hadoop] lujiefsi edited a comment on pull request #3561: YARN-10980:fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [geode-issues] 20211018 [jira] [Updated] (GEODE-9744) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20211018 [jira] [Updated] (HIVE-25617) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20211018 [jira] [Work logged] (HIVE-25617) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-yarn-issues] 20211018 [jira] [Comment Edited] (YARN-10980) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-yarn-issues] 20211018 [jira] [Resolved] (YARN-10980) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-gitbox] 20211018 [GitHub] [hive] lujiefsi opened a new pull request #2725: HIVE-25617:fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-yarn-issues] 20211018 [jira] [Commented] (YARN-10980) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [geode-issues] 20211018 [jira] [Created] (GEODE-9744) fix CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [geode-issues] 20211018 [jira] [Updated] (GEODE-9744) bug like CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [geode-issues] 20211018 [jira] [Updated] (GEODE-9744) bug CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [geode-issues] 20211018 [jira] [Updated] (GEODE-9744) like CVE-2020-8908 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_refsource_MISCx_transferred
• [pig-dev] 20211021 [GitHub] [pig] lujiefsi opened a new pull request #36: PIG-5417:Replace guava's Files.createTempDir() (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpujan2022.html (opens in a new tab)x_refsource_MISCx_transferred
• https://www.oracle.com/security-alerts/cpuapr2022.html (opens in a new tab)x_refsource_MISCx_transferred
• https://security.netapp.com/advisory/ntap-20220210-0003/ (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-5mg8-w23w-74h3 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-8908](https://trackcve.app/badge/CVE-2020-8908.svg)](https://trackcve.app/cve/CVE-2020-8908)

Record last updated 2 Nov 2026, 17:57 UTC.