CVE-2020-36970

PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter. Attackers can exploit the unsanitized file path input to access sensitive files like /etc/passwd by sending crafted requests to the getgif.php endpoint.

CVSS v4.0

6.9 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.4 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.27% chance of exploitation in the next 30 days, 20th percentile

Published

2026-01-28

Updated

2026-07-15

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/49054

References

• CVE Record
• NVD entry

Related

• CVE-2020-36969
• CVE-2020-36971
• CVE-2020-36968
• CVE-2020-36972
• CVE-2020-36967
• CVE-2020-36973