{"id":"CVE-2020-28348","aliases":["ALPINE-CVE-2020-28348","EUVD-2022-0848","GHSA-5x92-p4p5-33c4","GO-2022-0770"],"status":"published","title":"Path Traversal in HashiCorp Nomad","description":"HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0165,"percentile":0.76689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2020-11-24T02:31:12Z","modified":"2026-11-03T06:32:46Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/nomad","fixed_in":["0.10.8","0.11.7","0.12.8"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.14","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.10.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0-beta1"},{"fixed":"0.11.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0-beta1"},{"fixed":"0.12.8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0"},{"fixed":"0.10.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0-beta1"},{"fixed":"0.11.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"SEMVER","events":[{"introduced":"0.12.0-beta1"},{"fixed":"0.12.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0"},{"fixed":"0.10.8"},{"introduced":"0.11.0-beta1"},{"fixed":"0.11.7"},{"introduced":"0.12.0-beta1"},{"fixed":"0.12.8"}]}]}],"products":[{"vendor":"hashicorp","product":"nomad"}],"references":[{"url":"https://github.com/hashicorp/nomad/issues/9303","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0128-november-10-2020","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28348","tags":["advisory"]},{"url":"https://github.com/hashicorp/nomad/pull/9321","tags":["web","fix"]},{"url":"https://discuss.hashicorp.com/t/nomad-0-12-8-0-11-7-and-0-10-8-released/17491","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5x92-p4p5-33c4","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-28348","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-28348","description":"HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.","status":"published","published":"2020-11-24T02:31:12Z","modified":"2024-08-04T16:33:59.087Z","updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2022-0848","description":"HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.","status":"published","published":"2020-11-24T02:31:12Z","modified":"2024-08-04T16:33:59Z","updated_at":"2026-11-03T03:07:09.169254Z"}],"ghsa":[{"id":"GHSA-5x92-p4p5-33c4","title":"Path Traversal in HashiCorp Nomad","description":"HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature (github.com/hashicorp/nomad/drivers/docker) may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-10-02T13:44:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2020-28348","description":"HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.","status":"published","published":"2020-11-24T03:15:13.183Z","modified":"2026-06-17T03:10:19.22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":6.3,"vector":"AV:N/AC:M/Au:S/C:C/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:25.394006Z"}],"osv":[{"id":"ALPINE-CVE-2020-28348","description":"HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.","status":"published","published":"2020-11-24T03:15:13.183Z","modified":"2026-11-03T06:32:46.026541364Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2020-28348","description":"HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.","status":"published","published":"2020-11-24T03:15:13.183Z","modified":"2026-10-20T10:53:04.25209007Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"GHSA-5x92-p4p5-33c4","title":"Path Traversal in HashiCorp Nomad","description":"HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature (github.com/hashicorp/nomad/drivers/docker) may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.","status":"published","published":"2022-02-15T01:57:18Z","modified":"2024-08-21T15:41:48.898299Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"GO-2022-0770","title":"Path Traversal in HashiCorp Nomad in github.com/hashicorp/nomad","description":"Path Traversal in HashiCorp Nomad in github.com/hashicorp/nomad","status":"published","published":"2024-08-21T15:21:45Z","modified":"2026-03-03T04:50:52.120101Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}