CVE-2020-7040: Canonical Ubuntu Linux

High severity, CVSS 8.1. EPSS: 2.9% chance of exploitation in the next 30 days.

storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 20.04 only
• Debian Debian Linux: version 8.0 only
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only
• Storebackup Storebackup: up to and including 3.5

Published 2020-01-21. Last modified 2026-06-17.