CVE-2020-12443

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to bigbluebutton.properties. NOTE: this issue exists because of an ineffective mitigation to CVE-2020-12112 in which there was an attempted fix within an NGINX configuration file, without considering that the relevant part of NGINX is case-insensitive.

• CWE-22

• https://github.com/bigbluebutton/bigbluebutton/pull/9259/commits/b21ca8355a57286a1e6df96984b3a4c57679a463Patch, Third Party Advisory
• https://github.com/mclab-hbrs/BBB-POCExploit, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/pull/9259/commits/b21ca8355a57286a1e6df96984b3a4c57679a463Patch, Third Party Advisory
• https://github.com/mclab-hbrs/BBB-POCExploit, Third Party Advisory

Published

Apr 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12438An XSS vulnerability exists in the banners.php page of PHP-F…5.4
• CVE-2020-12439Grin before 3.1.0 allows attackers to adversely affect avail…5.3
• CVE-2020-1244A denial of service vulnerability exists when Connected User…7.1
• CVE-2020-12440Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-12441Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remot…9.8
• CVE-2020-12442Ivanti Avalanche 6.3 allows a SQL injection that is vaguely …9.8
• CVE-2020-12446The ene.sys driver in G.SKILL Trident Z Lighting Control thr…7.8
• CVE-2020-12447A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-00…7.5
• CVE-2020-12448GitLab EE 12.8 and later allows Exposure of Sensitive Inform…5.3
• CVE-2020-1245<p>An elevation of privilege vulnerability exists in Windows…7
• CVE-2020-12456A remote code execution vulnerability in Mitel MiVoice Conne…8.8
• CVE-2020-12457An issue was discovered in wolfSSL before 4.5.0. It mishandl…7.5