PT-2025-50507 · Spinetix · Spinetix Fusion Digital Signage

Published 2025-12-10 · Updated 2026-01-21 · CVE-2020-36883

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SpinetiX Fusion Digital Signage versions 3.4.8 and lower

Description The software contains an authenticated path traversal flaw. This allows attackers to manipulate file backup and deletion operations using unverified input parameters. Exploitation involves path traversal techniques within the index.php file to write backup files to arbitrary locations and delete files by manipulating backup and file delete requests. The vulnerability requires authentication.

Recommendations Update to a version of SpinetiX Fusion Digital Signage higher than 3.4.8.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-36883

Affected Products

Spinetix Fusion Digital Signage

References · 10

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5594.php · Exploit
• 🔥 https://exploit-db.com/exploits/48844 · Exploit
• https://osv.dev/vulnerability/CVE-2020-36883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36883 · Security Note
• https://github.com/Mbed-TLS/mbedtls · Note
• https://t.me/CVEtracker/39391 · Telegram Post
• https://twitter.com/CVEnew/status/1999108943168311651 · Twitter Post
• https://vulncheck.com/advisories/spinetix-fusion-digital-signage-authenticated-path-traversal-via-file-operations · Note
• https://spinetix.com · Note
• https://t.me/cveNotify/149434 · Telegram Post