CVE-2018-1999017

Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...

CVE-2018-1999016

Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...

CVE-2019-9642

An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created by the guest account, with execution via a...

CVE-2018-1999018

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...

Pydio Core End of Life (EOL) Detection

The Pydio Core version on the remote host has reached the end of life EOL and should not be used anymore. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Pydio Core <= 8.2.5 XSS Vulnerability

Pydio Core is prone to a cross-site scripting XSS vulnerability via the New URL Bookmark feature. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

CVE-2024-40124

Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...

CVE-2024-40124

Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...

PT-2025-17202 · Unknown · Pydio Core

Name of the Vulnerable Software and Affected Versions: Pydio Core versions 8.2.5 and earlier Description: The issue is related to Cross Site Scripting XSS via the New URL Bookmark feature. This allows for potential malicious script execution. Recommendations: For Pydio Core versions 8.2.5 and...

CVE-2024-40124

Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...

CVE-2024-40124

Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...

CVE-2024-40124

Summary (CVE-2024-40124): Pydio Core versions up to 8.2.5 are vulnerable to a cross-site scripting (XSS) flaw in the New URL Bookmark feature. The issue is confirmed across multiple sources (OpenVAS, Red Hat, CVE records). Remediation: upgrade to a version later than 8.2.5 or apply the hotfix/pat...

Pydio Core 安全漏洞

Pydio Core is a document sharing and collaboration platform core program from Pydio, Inc. A security vulnerability exists in Pydio Core 8.2.5 and earlier versions, which stems from a cross-site scripting vulnerability in the New URL Bookmark feature...

CVE-2024-40124

Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...

GO-2023-2344 Abstrium Pydio Cells Resource Injection vulnerability in github.com/pydio/cells

Abstrium Pydio Cells Resource Injection vulnerability in github.com/pydio/cells...

GO-2023-1809 go package pydio cells vulnerable to cross-site scripting in github.com/pydio/cells

go package pydio cells vulnerable to cross-site scripting in github.com/pydio/cells...

GO-2023-1808 Go package pydio/cells vulnerable to authorization bypass in github.com/pydio/cells

Go package pydio/cells vulnerable to authorization bypass in github.com/pydio/cells...

Exploit for Incorrect Authorization in Pydio Cells

PoC for CVE-2023-32749 This is a quick and dirty PoC I wrote...

Cross-Site Scripting (XSS)

github.com/pydio/cells is vulnerable to Cross-Site Scripting XSS attacks. The Amazon AWS SDK for JavaScript is used to create presigned URLs for Pydio Cells. It is feasible to create valid signatures for any download URLs since the secrets required to sign these URLs are hardcoded and made...

Privilege Escalation

github.com/pydio/cells is vulnerable to Privilege Escalation. The creation of external users for file sharing is possible with Pydio Cells. It is possible to give a new user arbitrary roles with access to all cells and non-personal workspaces by altering the HTTP request that is submitted when...