CVE-2020-36898 is a critical (CVSS 9.1) unauthenticated arbitrary file deletion flaw in QiHang Media Web Digital Signage 3.0.9. A POST to QH.aspx with file paths in the data parameter deletes files with web server permissions. No fixed version is confirmed, so restrict the endpoint.
What's affected
QiHang Media Web Digital Signage version 3.0.9, per the record and VulnCheck.
The record says the QH.aspx endpoint accepts a data parameter that holds file paths, and that directory traversal sequences let a remote attacker delete files the web server account can reach. No authentication is needed.
Unlike its sibling CVE-2020-36897, which allows uploads and code execution, this one affects availability and integrity: files can be removed. Deleting application or configuration files can break the service or open a way to further attacks.
I could not confirm a fixed version.
How to check if you're exposed
Check the signage product version in its administration screen. 3.0.9 is in scope.
Check for the vulnerable page:
find /path/to/webroot -iname "QH.aspx"
Then check whether the server is reachable from outside, and which accounts the web application runs as. The damage from this flaw is limited by what that account can delete, so a tightly scoped account helps.
Review backups. If the server holds content or configuration that would be hard to rebuild, confirm that a recent copy exists somewhere the web server cannot reach.
What to do now
- Find all QiHang signage servers, and their versions.
- Block QH.aspx at a reverse proxy or the web server until the vendor supplies a fix.
- Contact the vendor and track their response.
- Run the web application as an account with write access only to the folders it needs.
- Keep tested backups of signage content and configuration on storage that the web server cannot write to.
Why it matters
The class is CWE-22 (Path Traversal). The endpoint takes a path from the request and acts on it without making sure it stays inside the intended folder. Traversal sequences climb out of that folder, so the delete operation reaches any file the account can touch.
Deletion bugs are underrated. They do not leak data, so they score lower in some systems, but they can take a service down, remove logs that an investigator needs or delete a protective file to prepare another step. The record scores it 9.1, which is critical.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Quick check
Does this leak data?
The record describes deletion, not disclosure. Deleted files can still break the service or remove evidence.
Is login needed?
No. The record describes an unauthenticated flaw.
Sources
Last reviewed: 19 October 2026.
