CVE-2023-32749

CVE-2023-32749 的概念验证 这是我为 Pydio Cells 的 CVE-2023-32749 编写的一个快速粗糙的概念验证脚本。该脚本在提供有效凭证后，会创建一个拥有所有可用角色的新用户账户。 所有功劳归功于原始研究者。 安装 唯一的要求是 Python 的 requests 包，用于发送网络请求。如果您的系统上未安装，可以通过以下命令安装： root@kitploit: pip3 install -r requirements.txt 使用方法 root@kitploit: exploit.py -h -u USER -p PASSWORD -l URL PyDio...

CVE-2018-14772

CVE-2018-14772 Informações Este é um PoC de exploit de Execução Remota de Código para CVE-2018-14772, uma vulnerabilidade que descobri na plataforma de compartilhamento de arquivos pydio. Requer credenciais de administrador da aplicação pydio para funcionar. Você pode executar o exploit da seguin...

CVE-2023-32749-PoC

CVE-2023-32749 | Pydio Cells 未授权角色分配 针对影响 Pydio Cells 4.1.2 及更早版本的 CVE-2023-32749 的利用程序。低权限的已认证用户可以创建一个具有所有角色分配的新外部用户，从而获得对该实例中所有单元格和非个人工作区的访问权限。 受影响版本 Pydio Cells 4.1.2 及更早版本 已在 4.2.0、4.1.3、3.0.12 中修复 依赖 root@kitploit: pip install requests 使用方法 从已认证会话中获取一个 Bearer token（开发者工具 网络 任意 /a/ 请求...

CVE-2018-20718

CVE-2018-20718 Este é um POC para CVE-2018-20718. É uma vulnerabilidade de injeção de objetos PHP. A vulnerabilidade afeta todas as versões do Pydio anteriores à 8.2.1 e leva à execução remota de código sem autenticação. Foi originalmente encontrada pela RIPS. Encontrei um gadget em...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 is affected by a missing authorization flaw in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go. Unlike the sibling handler for GET /a/share/cell/{Uuid}, which enforces MatchPolicies with ResourcePolicyAction_READ, the link handler calls L...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

EUVD-2026-61205

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

PT-2026-77298

Name of the Vulnerable Software and Affected Versions Pydio Cells versions 5.0.0 through 5.0.2 Description An authorization bypass exists in the REST handler for the endpoint "GET /a/share/link/Uuid" within the idm/share/rest/handler.go file. The handler processes the Uuid variable from the path...

PYSEC-2026-902 PyDio Stored XSS Vulnerability

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...

Exploit for Incorrect Authorization in Pydio Cells

CVE-2023-32749 | Pydio Cells Unauthorised Role Assignment Exp...

CVE-2021-41324

Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files or Cells files belonging to any user via the nodes parameter for Copy and Move or via the Path parameter for Delete...

CVE-2019-20452

A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user with basic privileges can inject objects and achieve remote code execution...

CVE-2019-20453

A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution...

CVE-2020-12851

Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders repositories by uploading a custom generated ZIP file and leveraging the file extraction feature present in the web application. The extracted files will be placed in t...

CVE-2020-12852

The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating it...

CVE-2020-12847

Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the application’s mailer configuration. It is...

CVE-2020-12849

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user...

CVE-2020-12850

The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF such as version 2.0.3 have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the...