CVE-2020-16136

Name: CVE-2020-16136
Creator: NVD / NIST
Published: 2020-07-31T16:15:11.12+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.7/10EPSS 2.06%

Last modified Jun 17, 2026

CVE-2020-16136 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (accessible by the owner of the server process) via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files, however.. EPSS estimates a 2.06% chance of exploitation in the next 30 days.

Description

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (accessible by the owner of the server process) via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files, however.

Metrics

CVSS 3.1

7.7/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS Probability

2.06%

78.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-22

Affected Software

Vendor	Product	Versions
Tgstation13	Tgstation-Server	4.4.0
Tgstation13	Tgstation-Server	4.4.1

References

https://github.com/tgstation/tgstation-serverThird Party Advisory
https://github.com/tgstation/tgstation-server/security/advisories/GHSA-r8pp-42wr-2gc4Third Party Advisory
https://github.com/tgstation/tgstation-serverThird Party Advisory
https://github.com/tgstation/tgstation-server/security/advisories/GHSA-r8pp-42wr-2gc4Third Party Advisory

Timeline

Published: Jul 31, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-16136?

How severe is CVE-2020-16136?

CVE-2020-16136 has a CVSS score of 7.7/10 (HIGH severity). The EPSS model estimates a 2.06% probability of exploitation in the next 30 days.

How do I fix CVE-2020-16136?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-16136?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST