CVE-2020-36899 QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Disclosure
Remote attackers can read arbitrary files and directory contents without authentication by manipulating parameters in the QH.aspx endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36899?
CVE-2020-36899 is a high-severity path traversal vulnerability in Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Co., Ltd. QiHang Media Web Digital Signage, published on 10 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through unverified 'filename' and 'path' parameters. Attackers can exploit the QH.aspx endpoint to read arbitrary files and directory contents without authentication by manipulating download and getAll actions.
Weakness: CWE-530
Which versions are affected by CVE-2020-36899?
It affects 1 product.
Products include Howfor Qihang Media Web Digital Signage.
How do I fix CVE-2020-36899?
No fix has been published for CVE-2020-36899 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-36899 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36899 exists.
Other vulnerabilities in Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Co., Ltd. QiHang Media Web Digital Signage
Sources
Also known as GHSA-2fqg-hhc5-9x33.