{"action":"Upgrade hylafaxplus to 7.0.0-r1 or later.","affected":[{"fixed":"7.0.0-r1","introduced":"0"}],"component":"hylafaxplus","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.9","exploited":false,"fixed_versions":["7.0.0-r1"],"id":"tcs_01M5NC8G1J42SHPBQHAEM35SWD","modified_at":"2026-09-11T10:17:51.388156155Z","published_at":"2020-06-30T12:15:12.430Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2020-15396","https://security.alpinelinux.org/vuln/CVE-2020-15396"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2020-15396#Alpine:v3.9/hylafaxplus","url":"https://osv.dev/vulnerability/ALPINE-CVE-2020-15396"}],"summary":"In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to"}