EIBIZ i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability

Advisories

severity: high
date: December 10, 2025
Affecting: i-Media Server Digital Signage <= 3.8.0
CVE: CVE-2020-36893
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References: ExploitDB-48766
EIBIZ Homepage
Zero Science Disclosure (ZSL-2020-5585)
Credit: LiquidWorm as Gjoko Krstic of Zero Science Lab
Description: EIBIZ i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.