CVE-2020-36772

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.

• CWE-73
• CWE-610

• http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2024/Jan/25Exploit, Mailing List, Third Party Advisory
• https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100Release Notes
• https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands
• http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2024/Jan/25Exploit, Mailing List, Third Party Advisory
• https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100Release Notes
• https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands

Published

Jan 22, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36766An issue was discovered in the Linux kernel before 5.8.6. dr…3.3
• CVE-2020-36767tinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows …7.5
• CVE-2020-36768A vulnerability was found in rl-institut NESP2 Initial Relea…9.8
• CVE-2020-36769The Widget Settings Importer/Exporter Plugin for WordPress …5.4
• CVE-2020-36770pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 …9.8
• CVE-2020-36771CloudLinux CageFS 7.1.1-1 or below passes the authentication…7.8
• CVE-2020-36773Artifex Ghostscript before 9.53.0 has an out-of-bounds write…9.8
• CVE-2020-36774plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 an…5.5
• CVE-2020-36775In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2020-36776In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2020-36777In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2020-36778In the Linux kernel, the following vulnerability has been re…5.5