ReQuest Serious Play F3 Media Server <= 7.0.3 Unauthenticated Remote Code Execution

Advisories

severity: critical
date: December 5, 2025
Affecting: 7.0.3.4968
7.0.2.4954
6.5.2.4954
6.4.2.4681
6.3.2.4203
2.0.1.823
CVE: CVE-2020-36877
CVE type: CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CVSS: 9.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-48952
Zero Science Lab Disclosure (ZSL-2020-560)
ReQuest Product Homepage
Credit: Gjoko Krstic of Zero Science Lab
Description: ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.