PT-2026-5420 · Unknown · Popcorn Time

Published 2026-01-30 · Updated 2026-01-30 · CVE-2020-37059

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Popcorn Time version 6.2.1.14

Description Popcorn Time version 6.2.1.14 contains an unquoted service path issue that may allow local users with limited privileges to execute code with higher system privileges. An attacker can place malicious executables in directories like Program Files (x86) or the system root to be run with SYSTEM-level permissions when the service starts.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2020-37059

Affected Products

Popcorn Time

References · 5

• 🔥 https://exploit-db.com/exploits/48378 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37059 · Security Note
• https://t.me/CVEtracker/43307 · Telegram Post
• https://getpopcorntime.is · Note
• https://vulncheck.com/advisories/popcorn-time-update-service-unquoted-service-path · Note