CVE-2007-0007

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on...

3.6 LowFix available

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.

Exploit likelihood

0.39%Down 0.9 points since Feb 4, 2022

What each source reports

NVD Score used 3.6

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.

Record: CVE-2007-0007
CVSS 2.0: 3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Updated: 2026-11-02

CVE List No score

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.

Record: CVE-2007-0007
Updated: 2026-11-02

EUVDEUVD-2007-0011 No score

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.

Record: EUVD-2007-0011
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c89j-cg9r-r78f No score

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on...

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.

Record: GHSA-c89j-cg9r-r78f
Updated: 2026-11-02

OSV No score

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.

Record: CVE-2007-0007
Updated: 2026-11-02

OSVDEBIAN-CVE-2007-0007 No score

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.

Record: DEBIAN-CVE-2007-0007
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10798-1 No score

gnucash-4.6-1.3 on GA media

These are all security issues fixed in the gnucash-4.6-1.3 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10798-1
Updated: 2026-11-02

Affected products

gnucash

Affected packages

Affected packages
Package	Affected	Fixed
`gnucash` Debian:12	before 2.0.5-1	2.0.5-1
`gnucash` Debian:13	before 2.0.5-1	2.0.5-1
`gnucash` Debian:14	before 2.0.5-1	2.0.5-1
`gnucash` openSUSE:Tumbleweed	before 4.6-1.3	4.6-1.3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-0007 is a low vulnerability (CVSS 3.6) in Gnucash, published February 19, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in gnucash 2.0.5-1.

References

Show 8 moreShow less