Incydr (Code42)
CVE-2018-20131: The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive per…
The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| n/a n/a | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would not have access to.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.