Answer in brief
CVE-2020-8908 records a Low severity (CVSS 3.3) vulnerability in Temp directory permission issue in Guava. The current sources do not mark it as known exploited. The current feed maps Google LLC/Guava (generic), com.google.guava:guava (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Google LLC/Guava (generic), com.google.guava:guava (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Google LLC/Guavageneric | >=1.0 <32.0 | 32.0 |
| com.google.guava:guavamaven | >=0 <32.0.0-android | 32.0.0-android |
Published upstream
Dec 10, 2020
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 8, 2026
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Quoted source text, attributed separately from HOL analysis.