CVE-2020-8793

4.7 mediumEPSS 0.9%

Medium (4.7). EPSS 0.9% chance of exploitation in the next 30 days.

OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.

Severity

CVSS 3.1

4.7 medium

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-11-01)
CWEs: CWE-367, CWE-426
Published: 2020-02-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

canonical:ubuntu_linux
fedoraproject:fedora
opensmtpd:opensmtpd

References

http://seclists.org/fulldisclosure/2020/Feb/28
http://www.openwall.com/lists/oss-security/2020/02/24/4
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/
https://usn.ubuntu.com/4294-1/
https://www.openbsd.org/security.html

Check your stack JSON