CVE-2020-36883
SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operations
- State
- Published
- Severity
- 8.8 High
- Published
- Dec 10, 2025
- Updated
- Dec 11, 2025
- Reserved
- Dec 9, 2025
Description
SpinetiX Fusion Digital Signage 3.4.8 and lower contains an authenticated path traversal vulnerability that allows attackers to manipulate file backup and deletion operations through unverified input parameters. Attackers can exploit path traversal techniques in index.php to write backup files to arbitrary locations and delete files by manipulating backup and file delete requests.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Fusion Digital SignageSpenetiX AG |
|
References
- ExploitDB-48844exploit
- Official Product Homepageproduct
- Zero Science Lab Disclosure ZSL-2020-5594third-party-advisory
- Mbed TLS GitHub Repositoryproduct
- VulnCheck Advisory: SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operationsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.