Vulnerability · Published Dec 10, 2025 · Assigned by VulnCheck
CVE-2020-36883SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operations
High 8.8
In plain English
A high-severity path traversal in Fusion Digital Signage from SpenetiX AG. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Official description
SpinetiX Fusion Digital Signage 3.4.8 and lower contains an authenticated path traversal vulnerability that allows attackers to manipulate file backup and deletion operations through unverified input parameters. Attackers can exploit path traversal techniques in index.php to write backup files to arbitrary locations and delete files by manipulating backup and file delete requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SpenetiX AG | Fusion Digital Signage | 0 – through 3.4.8 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
References
- ExploitDB-48844 exploit
- Official Product Homepage product
- Zero Science Lab Disclosure ZSL-2020-5594 third-party-advisory
- Mbed TLS GitHub Repository product
- VulnCheck Advisory: SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operations third-party-advisory