CVE-2023-2976
Use of temporary directory for file creation in `FileBackedOutputStream` in Guava
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
| Vendor | |
| Product | guava |
| Ecosystems | |
| Industries | Technology |
| Published | Jun 14, 2023 |
| Last Updated | Feb 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for google guava
Be the first to know when new medium vulnerabilities affecting google guava are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Google / Guava
1.0 < 32.0.0
References
github.com: https://github.com/google/guava/issues/2575 security.netapp.com: https://security.netapp.com/advisory/ntap-20230818-0008/ intel.com: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01006.html security.netapp.com: https://security.netapp.com/advisory/ntap-20241108-0002/