CVE-2018-14772

CVE-2018-14772 情報 これは、pydio ファイル共有プラットフォームで発見した脆弱性 CVE-2018-14772 の PoC リモートコード実行エクスプロイトです。動作には pydio アプリケーションの管理者資格情報が必要です。以下のようにエクスプロイトを実行できます: 使用方法 root@kitploit: $ python exploit.py -h usage: exploit.py -h -t TARGET -u USERNAME -p PASSWORD -L LISTENERIP -P LISTENERPORT --payload PAYLOAD explo...

CVE-2018-20718

CVE-2018-20718 这是CVE-2018-20718的概念验证（POC）。它是一个PHP对象注入漏洞，影响Pydio 8.2.1之前的所有版本，并导致未认证远程代码执行。该漏洞最初由RIPS发现。 我在Pydio\Core\Controller\ShutdownScheduler中发现了一个gadget，如果与已知的GuzzleHttp\Psr7\FnStream gadget结合使用，可以实现远程代码执行。 利用示例 技术细节 https://blog.ripstech.com/2018/pydio-unauthenticated-remote-code-execution/...

CVE-2023-32749

CVE-2023-32749 の PoC これは、Pydio Cells の CVE-2023-32749 向けに作成した簡易 PoC です。このスクリプトは、有効な認証情報を指定すると、利用可能なすべてのロールを持つ新しいユーザーアカウントを作成します。 すべての功績は、元の研究者に帰属します。 インストール 唯一の要件は、Web リクエストを行うための Python の requests パッケージです。システムにインストールされていない場合は、以下のコマンドでインストールできます。 root@kitploit: pip3 install -r requirements.txt 使用...

CVE-2023-32749-PoC

CVE-2023-32749 | Pydio Cells 未授权角色分配 针对影响 Pydio Cells 4.1.2 及更早版本的 CVE-2023-32749 的利用程序。低权限的已认证用户可以创建一个具有所有角色分配的新外部用户，从而获得对该实例中所有单元格和非个人工作区的访问权限。 受影响版本 Pydio Cells 4.1.2 及更早版本 已在 4.2.0、4.1.3、3.0.12 中修复 依赖 root@kitploit: pip install requests 使用方法 从已认证会话中获取一个 Bearer token（开发者工具 网络 任意 /a/ 请求...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 is affected by a missing authorization flaw in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go. Unlike the sibling handler for GET /a/share/cell/{Uuid}, which enforces MatchPolicies with ResourcePolicyAction_READ, the link handler calls L...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

EUVD-2026-61205

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

PT-2026-77298

Name of the Vulnerable Software and Affected Versions Pydio Cells versions 5.0.0 through 5.0.2 Description An authorization bypass exists in the REST handler for the endpoint "GET /a/share/link/Uuid" within the idm/share/rest/handler.go file. The handler processes the Uuid variable from the path...

PYSEC-2026-902 PyDio Stored XSS Vulnerability

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...

Exploit for Incorrect Authorization in Pydio Cells

CVE-2023-32749 | Pydio Cells Unauthorised Role Assignment Exp...

CVE-2021-41324

Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files or Cells files belonging to any user via the nodes parameter for Copy and Move or via the Path parameter for Delete...

CVE-2019-20452

A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user with basic privileges can inject objects and achieve remote code execution...

CVE-2019-20453

A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution...

CVE-2020-12851

Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders repositories by uploading a custom generated ZIP file and leveraging the file extraction feature present in the web application. The extracted files will be placed in t...

CVE-2020-12852

The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating it...

CVE-2020-12847

Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the application’s mailer configuration. It is...

CVE-2020-12849

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user...

CVE-2020-12850

The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF such as version 2.0.3 have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the...