CVE-2020-12443: Bigbluebutton

Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days.

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to bigbluebutton.properties. NOTE: this issue exists because of an ineffective mitigation to CVE-2020-12112 in which there was an attempted fix within an NGINX configuration file, without considering that the relevant part of NGINX is case-insensitive.

Affected products

• Bigbluebutton Bigbluebutton: before 2.2.6 (fixed in 2.2.6)

Published 2020-04-29. Last modified 2026-06-17.