# SpinetiX Fusion has four flaws, including an authenticated path traversal

- Date: 2025-12-10
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2020-36883, CVE-2020-36886, CVE-2020-36887, CVE-2020-36888
- Products: [SpinetiX Elementi](https://signagelist.org/products/spinetix-elementi/)

NVD published 4 vulnerabilities in SpinetiX Fusion, covering path traversal, CSRF, information disclosure and username enumeration. In SpinetiX Fusion Digital Signage 3.4.8 and lower, an authenticated path traversal flaw lets attackers manipulate file backup and deletion operations through unverified input parameters.

## Sources

- [CVE-2020-36883](https://nvd.nist.gov/vuln/detail/CVE-2020-36883) (NIST NVD)
- [CVE-2020-36886](https://nvd.nist.gov/vuln/detail/CVE-2020-36886) (NIST NVD)
- [CVE-2020-36887](https://nvd.nist.gov/vuln/detail/CVE-2020-36887) (NIST NVD)
- [CVE-2020-36888](https://nvd.nist.gov/vuln/detail/CVE-2020-36888) (NIST NVD)
- [https://github.com/Mbed-TLS/mbedtls](https://github.com/Mbed-TLS/mbedtls)
- [https://www.exploit-db.com/exploits/48844](https://www.exploit-db.com/exploits/48844)

Page: https://signagelist.org/incidents/2025-12-spinetix-fusion-has-four-flaws-including-an/