CVE-2020-8908: Google Guava

Low severity, CVSS 3.3. EPSS: 0.9% chance of exploitation in the next 30 days.

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Affected products

  • Google Guava: before 32.0.0 (fixed in 32.0.0)
  • Netapp Active Iq Unified Manager: affected versions not specified
  • Oracle Commerce Guided Search: version 11.3.2 only
  • Oracle Communications Cloud Native Core Network Repository Function: version 1.14.0 only
  • Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.2.1 only
  • Oracle Communications Pricing Design Center: version 12.0.0.4.0 only; version 12.0.0.5.0 only
  • Oracle Data Integrator: version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Nosql Database: before 20.3 (fixed in 20.3)
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
  • Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only; version 21.12 only
  • Oracle Retail Customer Management And Segmentation Foundation: from 16.0, up to and including 19.0
  • Oracle WebLogic Server: version 14.1.1.0.0 only
  • Quarkus Quarkus: before 1.11.4 (fixed in 1.11.4)

Published 2020-12-10. Last modified 2026-06-17.