High
Security advisory
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-28007
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:17 UTC · Revision 1
Source evidence
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.
osv:CVE-2020-28007
Complete source record
{
"id": "d4e7331f97d63453251c55ff5dfbf8c2e96f182fc97b81ce47df84c9223cddac",
"url": "https://osv.dev/vulnerability/CVE-2020-28007",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-28007",
"summary": "Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.",
"evidence": "osv:CVE-2020-28007",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-28007",
"aliases": [
"CVE-2020-28007"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/exim/exim",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "919111edac911ba9c15422eafd7c5bf14d416d26"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.00"
},
{
"fixed": "4.94.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"exim-4.94.1",
"exim-4.94",
"exim-4.94-RC2",
"exim-4.94-RC1",
"exim-4_94_RC0",
"exim-4.93",
"exim-4.93-RC7",
"exim-4.93-RC6",
"exim-4.93-RC5",
"exim-4.93-RC4",
"exim-4.93-RC3",
"exim-4.93-RC2",
"exim-4.93-RC1",
"exim-4.93-RC0",
"exim-4.92-jgh",
"exim-4.92-RC6",
"exim-4.92",
"exim-4.92-RC5",
"exim-4.92-RC4",
"exim-4.92-RC3",
"exim-4.92-RC2",
"exim-4.92-RC1",
"exim-4_91",
"exim-4_91_RC4",
"exim-4_91_RC3",
"exim-4_91_RC2",
"exim-4_91_RC1",
"exim-4_90_RC4",
"exim-4_90",
"exim-4_90_RC3",
"exim-4_90_RC2",
"exim-4_90_RC1",
"exim-4.90devstart",
"exim-4_89_RC3",
"exim-4_89_RC1",
"exim-4_88",
"exim-4_87",
"exim-4_88_RC6",
"exim-4_88_RC5",
"exim-4_88_RC4",
"exim-4_88_RC3",
"exim-4_88_RC2",
"exim-4_88_RC1",
"exim-4_87_RC7",
"exim-4_87_RC6",
"exim-4_87_RC5",
"exim-4_87_RC4",
"exim-4_84",
"exim-4_86",
"exim-4_85",
"exim-4_87_RC3",
"exim-4_87_RC2",
"exim-4_87_RC1",
"exim-4_86_RC5",
"exim-4_86_RC4",
"exim-4_86_RC3",
"exim-4_86_RC2",
"exim-4_86_RC1",
"exim-4_85_RC4",
"exim-4_85_RC3",
"exim-4_85_RC2",
"exim-4_85_RC1",
"exim-4_84_RC2",
"exim-4_84_RC1",
"exim-4_83",
"exim-4_83_RC3",
"exim-4_83_RC2",
"exim-4_83_RC1",
"exim-4_82",
"exim-4_82_RC5",
"exim-4_82_RC4",
"exim-4_82_RC3",
"exim-4_82_RC2",
"exim-4_82_RC1",
"exim-4_80",
"exim-4_80_RC7",
"exim-4_80_RC6",
"exim-4_80_RC5",
"exim-4_80_RC4",
"exim-4_80_RC3",
"exim-4_80_RC2",
"exim-4_80_RC1",
"exim-4_77",
"exim-4_77_RC4",
"exim-4_77_RC3",
"exim-4_77_RC2",
"exim-4_77_RC1",
"exim-4_76",
"exim-4_76_RC2",
"exim-4_76_RC1",
"exim-4_75",
"exim-4_75_RC3",
"exim-4_75_RC2",
"exim-4_75_RC1",
"exim-4_74",
"exim-4_74_RC1",
"exim-4_73",
"exim-4_73_RC1",
"exim-4_73_RC00",
"exim-4_72",
"exim-4_72_RC2",
"exim-4_72_RC1",
"exim-4_71",
"exim-4_70",
"exim-4_70_RC4",
"exim-4_70_RC3",
"DEVEL_PDKIM_START",
"exim-4_69",
"exim-4_68",
"exim-4_67",
"exim-4_66",
"exim-4_65",
"exim-4_64",
"exim-4_63",
"exim-4_62",
"exim-4_61",
"exim-4_54",
"exim-4_53",
"exim-4_52",
"exim-4_51",
"exim-4_50"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-28007.json",
"vanir_signatures": [
{
"id": "CVE-2020-28007-a5b97121",
"digest": {
"length": 86,
"function_hash": "85807556721849417698167290800033609961"
},
"source": "https://github.com/exim/exim/commit/919111edac911ba9c15422eafd7c5bf14d416d26",
"target": {
"file": "src/src/smtp_in.c",
"function": "bdat_ungetc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-28007-f33c15e3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2970847905863908930961351479348962244",
"259127508678304675853565838131490768076",
"16856440449629165604374376294870505588",
"21031574626938302228709321949938569854",
"66694532801356984293692391694813765468",
"228435147706632689035739186300622821874",
"137018139142916213668559470023354199721",
"262955889687131153967951266340364206508",
"122233694988885115887188843215612136724",
"55546132595750780137850156557040648213",
"178043897109541241882122479475000937559",
"311496951671523793228361465075141960070"
]
},
"source": "https://github.com/exim/exim/commit/919111edac911ba9c15422eafd7c5bf14d416d26",
"target": {
"file": "src/src/smtp_in.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:12:02Z"
}
}
],
"modified": "2026-10-24T14:12:02.978782523Z",
"provider": "osv",
"references": [
"https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28007-LFDIR.txt"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-28007",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443300,
"published_at": "2021-05-06T13:15:09.263+00:00"
}