CVE-2020-37059
Published: 30 January 2026
Summary
CVE-2020-37059 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Getpopcorntime (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 3.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and CM-7 (Least Functionality).
Deeper analysis
CVE-2020-37059 is an unquoted service path vulnerability (CWE-428) in Popcorn Time version 6.2.1.14. The issue resides in the service configuration, where the path to the executable lacks proper quotation, enabling local privilege escalation on affected Windows systems.
A local non-privileged user (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N). By inserting a malicious executable into directories such as Program Files (x86) or the system root, the attacker can have it executed with SYSTEM-level privileges during service startup, potentially achieving high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Advisories and exploit details are documented in references including https://getpopcorntime.is, https://www.exploit-db.com/exploits/48378, and https://www.vulncheck.com/advisories/popcorn-time-update-service-unquoted-service-path, which cover the Popcorn Time update service vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30955
Vulnerability details
Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can insert malicious executables in Program Files (x86) or system root directories to be executed with SYSTEM-level…
more
permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception by unquoted path (T1574.009) for local privilege escalation (T1068) via malicious executable execution at service startup with SYSTEM rights.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires secure configuration settings for services, including properly quoting executable paths to directly prevent unquoted service path privilege escalation.
Mandates identification, reporting, and timely remediation of flaws like CVE-2020-37059 through patching or mitigation of the vulnerable Popcorn Time service.
Enforces least functionality by prohibiting or restricting unnecessary services such as the Popcorn Time update service, eliminating the vulnerable configuration.