{"id":"CVE-2020-27534","aliases":["GHSA-6hwg-w5jg-9c6x"],"url":"https://o3.security/vulnerability/CVE-2020-27534","summary":"Path Traversal in Moby builder","details":"util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.","published":"2020-12-30T23:15:15.297Z","modified":"2026-08-07T11:48:28.734451752Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/moby/moby","fixedVersion":"19.03.9"},{"ecosystem":"Go","name":"github.com/docker/docker","fixedVersion":"19.03.9"}],"fix":{"url":"https://github.com/moby/buildkit/pull/1462","label":"moby/buildkit#1462"},"references":[{"type":"ADVISORY","url":"http://web.archive.org/web/20200530054359/https://docs.docker.com/engine/release-notes/"},{"type":"ADVISORY","url":"https://github.com/moby/buildkit/pull/1462"},{"type":"ADVISORY","url":"https://github.com/moby/moby/pull/40877"},{"type":"ADVISORY","url":"https://golang.org/pkg/io/ioutil/#TempDir"},{"type":"ADVISORY","url":"https://golang.org/pkg/os/#TempDir"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:48:28.734451752Z"}}