VULNERABILITY INTELLIGENCE
CVE-2020-36970
CVSS score8.4 HIGH
EPSS probability0.29%
CISA KEVNot currently listed
Published2026-01-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter. Attackers can exploit the unsanitized file path input to access sensitive files like /etc/passwd by sending crafted requests to the getgif.php endpoint.
Weakness classification
- disclosure@vulncheck.com: CWE-22