CVE-2020-36882 Flexsense DiskBoss Application Crash Denial of Service

What is CVE-2020-36882?

CVE-2020-36882 is a high-severity vulnerability in Flexsense DiskBoss, published on 5 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Flexsense DiskBoss 7.7.14 allows unauthenticated attackers to upload arbitrary files via /Command/Search Files/Directory field, leading to a denial of service by crashing the application.

Weakness: CWE-434

Which versions are affected by CVE-2020-36882?

It affects 1 product.

Products include Flexense Diskboss.

How do I fix CVE-2020-36882?

No fix has been published for CVE-2020-36882 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36882 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36882 exists.

Other vulnerabilities in Flexsense DiskBoss

• CVE-2018-5262 Memory corruption in n/a Critical 9.8
• CVE-2020-36880 Flexsense DiskBoss 'Reports and Data Directory' Buffer Overflow High 8.6
• CVE-2020-36881 Flexsense DiskBoss 'Add Input Directory' Buffer Overflow High 8.6
• CVE-2018-5261 Weak cryptography in n/a High 8.1
• CVE-2017-7310 Memory corruption in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qwh8-pvv2-phjv.