CVE-2019-20354

CVE-2019-20354 is a path traversal vulnerability affecting piSignage versions prior to 2.6.4, allowing an authenticated low-privilege attacker to download arbitrary files from the Raspberry Pi via the player API. Rated Medium (CVSS 4.3), this flaw has a low attack complexity and requires network access and authentication, potentially leading to unauthorized information disclosure. While not listed on CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.