What is CVE-2020-36898?

CVE-2020-36898 is a critical-severity vulnerability in Howfor Qihang Media Web Digital Signage, classified under Path Traversal. CVSS score: 9.1/10. Published 2025-12-10.

How severe is CVE-2020-36898?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Path Traversal in Howfor Qihang Media Web Digital Signage

CVE-2020-36898

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.016 (73.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Affected products

Howfor Qihang_media_web_digital_signage — versions 3.0.9
Shenzhen Xingmeng Qihang Media Co., Ltd.guangzhou Hefeng Automation Technology Ltd. Web Digital Signage — versions 3.0.9

Weakness classification (CWE)

CWE-22 — Path Traversal

References

disclosure@vulncheck.com (Exploit, VDB Entry, Third Party Advisory, exploit)
disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Exploit, vendor-advisory, Third Party Advisory, vdb-entry)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2020-36898?: CVE-2020-36898 is a critical-severity vulnerability in Howfor Qihang Media Web Digital Signage, classified under Path Traversal. CVSS score: 9.1/10. Published 2025-12-10.
How severe is CVE-2020-36898?: Critical severity. CVSS v3 base score is 9.1 out of 10.