CVE-2020-10870
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could...
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
- Record
CVE-2020-10870- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AC:L/AV:L/A:H/C:N/I:N/PR:L/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2020-3276
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
- Record
EUVD-2020-3276- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AC:L/AV:L/A:H/C:N/I:N/PR:L/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2jv4-vc4g-7mp7 No score
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could...
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
- Record
GHSA-2jv4-vc4g-7mp7- Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
- Record
CVE-2020-10870- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-330
- Updated
- 2026-11-02
OSV
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
- Record
CVE-2020-10870- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-10870
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
- Record
DEBIAN-CVE-2020-10870- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-10870
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
- Record
UBUNTU-CVE-2020-10870- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11541-1 No score
zim-0.73.5-1.2 on GA media
These are all security issues fixed in the zim-0.73.5-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11541-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zimDebian:12 |
before 0.72.1-1 | 0.72.1-1 |
zimDebian:13 |
before 0.72.1-1 | 0.72.1-1 |
zimDebian:14 |
before 0.72.1-1 | 0.72.1-1 |
zimUbuntu:16.04:LTS |
All versions, plus listed versions 0.63-10.65-10.65-2 |
None known |
zimUbuntu:18.04:LTS |
All versions, plus listed versions 0.67-10.67-20.68~rc1-2 |
None known |
zimUbuntu:20.04:LTS |
All versions, plus listed versions 0.72.0-1 |
None known |
zimopenSUSE:Tumbleweed |
before 0.73.5-1.2 | 0.73.5-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10870 is a medium vulnerability (CVSS 5.5) in Zim-wiki Zim, published March 23, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in zim 0.72.1-1.