Medium severity4.3NVD Advisory· Published Jan 6, 2020· Updated Jun 17, 2026

CVE-2019-20354

Description

The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

piSignage/piSignage2 versions
cpe:2.3:a:pisignage:pisignage:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:pisignage:pisignage:*:*:*:*:*:*:*:*range: <2.6.4
- (no CPE)range: <2.6.4
piSignage/piSignagedescription

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/155864/piSignage-2.6.4-Directory-Traversal.htmlnvdExploitThird Party AdvisoryVDB Entry
github.com/colloqi/piSignage/issues/97nvdExploitThird Party Advisory
github.com/colloqi/piSignage/blob/master/RELEASE%20NOTES.mdnvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.007
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000