Vulnerability · Published Dec 10, 2025 · Assigned by VulnCheck
CVE-2020-36893Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability
High 8.7
In plain English
A high-severity path traversal in i-Media Server Digital Signage from EIBIZ Co.,Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)1.6%top 24.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EIBIZ Co.,Ltd. | i-Media Server Digital Signage | 0 – through 3.8.0 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- ExploitDB-48766 exploit
- EIBIZ Co.,Ltd. Product Web Page product
- Zero Science Advisory ID ZSL-2020-5585 vendor-advisory, vdb-entry
- VulnCheck Advisory: Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability third-party-advisory