{"id":"CVE-2020-8793","details":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.","modified":"2026-04-10T09:50:27.165855Z","published":"2020-02-25T17:15:13.103Z","references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/"},{"type":"ADVISORY","url":"http://seclists.org/fulldisclosure/2020/Feb/28"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4294-1/"},{"type":"ADVISORY","url":"https://www.openbsd.org/security.html"},{"type":"EVIDENCE","url":"http://www.openwall.com/lists/oss-security/2020/02/24/4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opensmtpd/opensmtpd","events":[{"introduced":"0"},{"fixed":"555d2121736acdd70453b24b94c8c2996d9ab5f9"}],"database_specific":{"versions":[{"introduced":"0"},{"fixed":"6.6.4"}]}}],"versions":["6.6.1p1","6.6.2p1","6.6.3p1","l","opensmtpd-20121030111957p1","opensmtpd-20121106111009p1","opensmtpd-20121107175757p1","opensmtpd-20121113231010p1","opensmtpd-201211152324p1","opensmtpd-201211232348p1","opensmtpd-201211261224p1","opensmtpd-201212031111p1","opensmtpd-201212081318p1","opensmtpd-201212222206p1","opensmtpd-201301031733p1","opensmtpd-201301111154p1","opensmtpd-201301191220p1","opensmtpd-201301241740p1","opensmtpd-201301252211p1","opensmtpd-201301281310p1","opensmtpd-201302051638p1","opensmtpd-201302141353p1","opensmtpd-201302152354p1","opensmtpd-201302212015p1","opensmtpd-201303011853p1","opensmtpd-201303201252p1","opensmtpd-201303211343p1","opensmtpd-201303221610p1","opensmtpd-201303311750p1","opensmtpd-201304041639p1","opensmtpd-201305171925p1","opensmtpd-201305171950p1","opensmtpd-201305241932p1","opensmtpd-201306071637p1","opensmtpd-201306211627p1","opensmtpd-201306271531p1","opensmtpd-201307091512p1","opensmtpd-201307121003p1","opensmtpd-201307151923p1","opensmtpd-201307191003p1","opensmtpd-201307191119p1","opensmtpd-201307221453p1","opensmtpd-201307290744p1","opensmtpd-201309091202p1","opensmtpd-201309121848p1","opensmtpd-201309121931p1","opensmtpd-201309201537p1","opensmtpd-201309241457p1","opensmtpd-201309241712p1","opensmtpd-201309241818p1","opensmtpd-201309251624p1","opensmtpd-201309261726p1","opensmtpd-201310081839p1","opensmtpd-201310101759p1","opensmtpd-201310231634p1","opensmtpd-201310241356p1","opensmtpd-201310251946p1","opensmtpd-201310281424p1","opensmtpd-201311071830p1","opensmtpd-201311181634p1","opensmtpd-201311182347p1","opensmtpd-201311201707p1","opensmtpd-201311261029p1","opensmtpd-201311270853p1","opensmtpd-201311281211p1","opensmtpd-201311292259p1","opensmtpd-201312021552p1","opensmtpd-201312021558p1","opensmtpd-201312081717p1","opensmtpd-201312131550p1","opensmtpd-201312142054p1","opensmtpd-201401061555p1","opensmtpd-201401201010p1","opensmtpd-201401201614p1","opensmtpd-201401202159p1","opensmtpd-201401231518p1","opensmtpd-201401241552p1","opensmtpd-201404151432p1","opensmtpd-201405071644p1","opensmtpd-201405121644p1","opensmtpd-201405121707p1","opensmtpd-201405142229p1","opensmtpd-201405142325p1","opensmtpd-201405202105p1","opensmtpd-201406061833p1","opensmtpd-201406170940p1","opensmtpd-201406190036p1","opensmtpd-201406192219p1","opensmtpd-201406192306p1","opensmtpd-201410012105p1","opensmtpd-201410040019p1","opensmtpd-201410131657p1","opensmtpd-201410152136p1","opensmtpd-201411042328p1","opensmtpd-201411052125p1","opensmtpd-201412241507p1","opensmtpd-201501060207p1","opensmtpd-201502012312p1","opensmtpd-201505091607p1","opensmtpd-201505121836p1","opensmtpd-201505241924p1","opensmtpd-201506020910p1","opensmtpd-201506112227p1","opensmtpd-201601051911p1","opensmtpd-201602031446p1","opensmtpd-201602120826p1","opensmtpd-201602131612p1","opensmtpd-201602131907p1","opensmtpd-201605221711p1","opensmtpd-201606062256p1","opensmtpd-201606062303p1","opensmtpd-201606071034p1","opensmtpd-201606152203p1","opensmtpd-201606220754p1","opensmtpd-201609141253p1","opensmtpd-201702130941p1","opensmtpd-201801101420p1","opensmtpd-5.0p1","opensmtpd-5.2.1p1","opensmtpd-5.3p1","opensmtpd-5.4.2p1","opensmtpd-5.9.1p1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-8793.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"32"}]},{"events":[{"introduced":"0"},{"last_affected":"18.04"}]},{"events":[{"introduced":"0"},{"last_affected":"19.10"}]}],"vanir_signatures":[{"signature_type":"Function","id":"CVE-2020-8793-7da4040d","digest":{"length":852,"function_hash":"196875953881991152077236116624259068501"},"deprecated":false,"target":{"file":"smtpd/queue_fs.c","function":"queue_fs_envelope_create"},"source":"https://github.com/opensmtpd/opensmtpd/commit/555d2121736acdd70453b24b94c8c2996d9ab5f9","signature_version":"v1"},{"signature_type":"Line","id":"CVE-2020-8793-8fca902c","digest":{"threshold":0.9,"line_hashes":["242575823212615086944252627364996250139","191066550062516158912985716223257094754","166787329513173112996708886338970170939","256753418468187729585530898156176574718","273979709428202467439049274088971250784"]},"deprecated":false,"target":{"file":"smtpd/queue_fs.c"},"source":"https://github.com/opensmtpd/opensmtpd/commit/555d2121736acdd70453b24b94c8c2996d9ab5f9","signature_version":"v1"}],"vanir_signatures_modified":"2026-04-10T09:50:27Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}