CVE-2020-37027

Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attackers can set malicious commands in the extra scripts field and trigger processing to execute remote code on the vulnerable Sickbeard installation.

CVSS v4.0

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.34% chance of exploitation in the next 30 days, 82th percentile

Published

2026-01-30

Updated

2026-02-03

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48646

References

• CVE Record
• NVD entry

Related

• CVE-2020-37026
• CVE-2020-37028
• CVE-2020-37025
• CVE-2020-37029
• CVE-2020-37024
• CVE-2020-37030