---
id: CVE-2020-27534
title: >-
  moby/buildkit: calls os.OpenFile with a potentially unsafe qemu-check
  temporary pathname (CVE-2020-27534)
summary: >-
  A flaw was found in moby. Moby buildkit calls os.OpenFile with a potentially
  unsafe qemu-check temporary pathname, constructed with an empty first argument
  in an ioutil.TempDir call.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: vendor
cwe: CWE-22
vendor: Red Hat
product: github.com/moby/moby
affected:
  - github.com/moby/moby < 19.03.9
  - github.com/docker/docker < 19.03.9
patched:
  - github.com/moby/moby 19.03.9
  - github.com/docker/docker 19.03.9
published: '2020-12-31'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T04:26:09+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-27534.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-27534.json
  - url: 'https://access.redhat.com/security/cve/CVE-2020-27534'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1921154'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2020-27534'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-27534'
  - url: 'https://github.com/moby/buildkit/pull/1462'
  - url: 'https://github.com/moby/moby/pull/40877'
  - url: >-
      http://web.archive.org/web/20200530054359/https://docs.docker.com/engine/release-notes
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.01766
epssPercentile: 0.78151
aliases:
  - GHSA-6hwg-w5jg-9c6x
ecosystem: go
ingestedAt: '2026-09-12T03:13:01.759Z'
---

## Overview

A flaw was found in moby. Moby buildkit calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-27534.json)

**moby/buildkit: calls os.OpenFile with a potentially unsafe qemu-check temporary pathname** — rated Moderate by Red Hat. Released 2020-12-31, updated 2026-10-14.

Not affected:

- Red Hat OpenShift Container Platform 4
- Red Hat Quay 3

## Remediation

Refer to the advisory for fix availability.

## Package advisory (CVE-2020-27534)

Affected packages:

- `github.com/moby/moby < 19.03.9`
- `github.com/docker/docker < 19.03.9`

Patched in:

- `github.com/moby/moby 19.03.9`
- `github.com/docker/docker 19.03.9`

Source: https://osv.dev/vulnerability/GHSA-6hwg-w5jg-9c6x