Path Traversal in Howfor Qihang Media Web Digital Signage
CVE-2020-36898
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.017 (76.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.017 · change: -0.000
Affected products
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/48749 (Exploit, VDB Entry, Third Party Advisory, exploit)
- www.howfor.com (Product, product)
- www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php (Exploit, vendor-advisory, Third Party Advisory, vdb-entry)
- www.vulncheck.com/advisories/qihang-media-web-digital-signage-unauthenticated-a… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2020-36898?
- CVE-2020-36898 is a critical-severity vulnerability in Howfor Qihang Media Web Digital Signage, classified under Path Traversal. CVSS score: 9.1/10. Published 2025-12-10.
- How severe is CVE-2020-36898?
- Critical severity. CVSS v3 base score is 9.1 out of 10.