CVE-2020-36893

8.7 highEPSS 1.6%

High (8.7) in eibiz i-media server digital signage. EPSS 1.6% chance of exploitation in the next 30 days.

Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2025-12-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

eibiz:i-media_server_digital_signage

References

http://www.eibiz.co.th
https://www.exploit-db.com/exploits/48766
https://www.vulncheck.com/advisories/eibiz-i-media-server-digital-signage-directory-traversal-vulnerability
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5585.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5585.php

Check your stack JSON