{"id":"CVE-2020-27534","aliases":["GHSA-6hwg-w5jg-9c6x"],"title":"Path Traversal in Moby builder","summary":"Path Traversal in Moby builder","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"moby","product":"github.com/moby/moby","ecosystem":"go","affected":["github.com/moby/moby < 19.03.9","github.com/docker/docker < 19.03.9"],"patched":["github.com/moby/moby 19.03.9","github.com/docker/docker 19.03.9"],"published":"2024-01-31","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:09.240988294Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6hwg-w5jg-9c6x","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27534"},{"url":"https://github.com/moby/buildkit/pull/1462"},{"url":"https://github.com/moby/moby/pull/40877"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921154"},{"url":"http://web.archive.org/web/20200530054359/https://docs.docker.com/engine/release-notes"}],"tags":["osv","go"],"epss":0.01766,"epssPercentile":0.77092,"ingestedAt":"2026-09-12T03:13:01.759Z","slug":"CVE-2020-27534","body":"## Overview\n\nutil/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.\n\n## Affected packages\n\n- `github.com/moby/moby < 19.03.9`\n- `github.com/docker/docker < 19.03.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/moby/moby 19.03.9`\n- `github.com/docker/docker 19.03.9`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.2,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}