CVE-2020-36883

SpinetiX Fusion Digital Signage 3.4.8 and lower contains an authenticated path traversal vulnerability that allows attackers to manipulate file backup and deletion operations through unverified input parameters. Attackers can exploit path traversal techniques in index.php to write backup files to arbitrary locations and delete files by manipulating backup and file delete requests.

• CWE-22

• https://github.com/Mbed-TLS/mbedtlsNot Applicable
• https://www.exploit-db.com/exploits/48844Exploit, Third Party Advisory, VDB Entry
• https://www.spinetix.comProduct
• https://www.vulncheck.com/advisories/spinetix-fusion-digital-signage-authenticated-path-traversal-via-file-operationsThird Party Advisory
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5594.phpExploit, Third Party Advisory
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5594.phpExploit, Third Party Advisory

Published

Dec 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36878ReQuest Serious Play Media Player 3.0 contains an unauthenti…8.7
• CVE-2020-36879Flexsense DiskBoss 11.7.28 allows unauthenticated attackers …8.5
• CVE-2020-3688Possible buffer overflow while parsing mp4 clip with corrupt…9.8
• CVE-2020-36880Flexsense DiskBoss 7.7.14 contains a local buffer overflow v…7.8
• CVE-2020-36881Flexsense DiskBoss 7.7.14 contains a local buffer overflow v…7.8
• CVE-2020-36882Flexsense DiskBoss 7.7.14 allows unauthenticated attackers t…7.5
• CVE-2020-36884BrightSign Digital Signage Diagnostic Web Server 8.2.26 and …6.9
• CVE-2020-36885Sony IPELA Network Camera 1.82.01 contains a stack buffer ov…9.8
• CVE-2020-36886SpinetiX Fusion Digital Signage 3.4.8 contains a cross-site …8.8
• CVE-2020-36887SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenti…7.5
• CVE-2020-36888SpinetiX Fusion Digital Signage 3.4.8 contains a username en…5.3
• CVE-2020-36889A stored cross-site scripting vulnerability in Kentico Xperi…5.4