CVE-2020-36970

MEDIUM

PMB 5.6 - 'chemin' Local File Disclosure

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-36970 has a selected CVSS score of 6.9 (medium); EIP currently links 1 catalogued exploit.

Description

PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter. Attackers can exploit the unsanitized file path input to access sensitive files like /etc/passwd by sending crafted requests to the getgif.php endpoint.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 28, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

PMB Services

Browse PMB Services / PMB Services
CVE List5.6affected

Proofs of concept

1

Catalogued exploits

ExploitDBPMB 5.6 - 'chemin' Local File DisclosureExploitDB exploitby 41-trkNot analyzed1 file
ExploitDB
PoC details

References

5