CVE-2020-36893

Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability

High8.7EPSS 1.6%

Published: 10 Dec 2025
Updated: 1 Oct 2026
Reserved: 9 Dec 2025
Assigned by: VulnCheck

Description

Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.

Scores

CVSS scores of CVE-2020-36893, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 1.6% · top 25% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)All about CWE-22 and its CVEs

Affected products

EIBIZ Co.,Ltd. · i-Media Server Digital Signage
- affected ≤ 3.8.0

References (4)

ExploitDB-48766 (opens in a new tab)exploit
EIBIZ Co.,Ltd. Product Web Page (opens in a new tab)product
Zero Science Advisory ID ZSL-2020-5585 (opens in a new tab)vendor-advisoryvdb-entryexploit
VulnCheck Advisory: Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-36893](https://trackcve.app/badge/CVE-2020-36893.svg)](https://trackcve.app/cve/CVE-2020-36893)

Record last updated 1 Oct 2026, 15:19 UTC.