CVE-2020-36970: Pmb Services

High severity, CVSS 8.4. EPSS: 0.3% chance of exploitation in the next 30 days.

PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter. Attackers can exploit the unsanitized file path input to access sensitive files like /etc/passwd by sending crafted requests to the getgif.php endpoint.

Affected products

• Pmb Services Pmb Services: version 5.6 only

Published 2026-01-28. Last modified 2026-06-17.