Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Affected Packages

Maven com.google.guava:guava

Affected versions: 1.0 (fixed in 32.0.0-android)

Related CVEs

CVE-2023-2976

Key Information

GHSA ID

GHSA-7g45-4rm6-3mm3

Published

June 14, 2023 6:30 PM

Last Modified

February 13, 2025 6:58 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

com.google.guava:guava

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 27, 2025 6:35 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.