CVE-2019-12902

Pydio Cells vulnerable before version 1.5.0. The issue is incomplete cleanup of a user’s data on deletion, allowing a new user with the same User ID to recover the deleted user’s data. Affected platform: Pydio Cells prior to 1.5.0; root cause: data cleanup gap during deletion. Impact: potential i...

CVE-2019-12901

Pydio Cells (before version 1.5.0) contains an input handling flaw where '../../' path elements are not neutralized, enabling a user with minimal privileges to upload or delete files in an unprivileged directory and thus escalate privileges. The issue is documented across multiple sources (NVD, R...

CVE-2019-12903

CVE-2019-12903 affects Pydio Cells prior to 1.5.0. When a Name field is supplied in an unexpected Unicode format, the system mishandles the input and includes the database column/table name in the error message, leading to information disclosure. Practical impact: exposure of underlying database ...

CVE-2020-12847

CVE-2020-12847 affects Pydio Cells 2.0.4. An authenticated administrator can modify the mailer configuration (sendmail engine) and change the path to the sendmail binary without restriction, allowing execution of an arbitrary binary on the server. This is part of a set of vulnerabilities disclose...

CVE-2020-12852

Summary: CVE-2020-12852 concerns Pydio Cells 2.0.4. The update feature lets an administrator set a custom update URL and a public RSA key used to validate the downloaded update package. The update process downloads a binary from the server response, validates its checksum and signature, and repla...

CVE-2020-12851

Summary of CVE-2020-12851 (Pydio Cells 2.0.4): An authenticated user can write or overwrite files in another user’s personal and cells folders by uploading a crafted ZIP and triggering the web app’s file extraction feature. The vulnerability is unlocked via the ZIP extraction mechanism, which pla...

CVE-2020-12853

CVE-2020-12853 affects Pydio Cells 2.0.4 and is a cross-site scripting (XSS) vulnerability demonstrated through stored XSS via file uploads (e.g., HTML/JS in personal cells) and via profile pictures. Proofs of concept show an attacker exploiting uploaded SVG/HTML payloads to execute JavaScript in...

CVE-2020-12849

CVE-2020-12849 affects Pydio Cells 2.0.4. The vulnerability is a Stored Cross-Site Scripting (XSS) in profile pictures: any user can upload a profile image (including SVGs with embedded JavaScript) that can be accessed via a direct URL by any user (authenticated or not). Exploitation can trigger ...

CVE-2020-12848

CVE-2020-12848 (Pydio Cells 2.0.4) permits an authenticated user who shares a file via a public link to create a hidden backend account with a random username. An attacker with access to the public link can obtain the hidden username/password and log in, gaining actions not available to public sh...

CVE-2023-32749

CVE-2023-32749 affects Pydio Cells. An attacker can modify the HTTP request when creating external users, permitting assignment of arbitrary roles to the new account. If all roles are granted, the attacker gains access to all cells and non-personal workspaces. Documented impact is privilege escal...

CVE-2020-12850

Affected product: Pydio Cells Enterprise OVF 2.0.4 (and related 2.0.x releases). The Red Hat/ENISA and CoreLabs advisories describe a set of vulnerabilities in the Pydio Cells 2.0.4 appliance that enable remote code execution, privilege escalation, and arbitrary file operations through multiple v...

CVE-2023-32750

CVE-2023-32750 affects Pydio Cells up to version 4.1.2 and is a Server-Side Request Forgery (SSRF) in the background job subsystem. The vulnerability arises from the the  implementation of the "remote-download" job, which can cause the backend to perform an HTTP GET to a user-specified URL and ...

CVE-2023-32751

CVE-2023-32751 affects Pydio Cells 4.1.2 and earlier. The vulnerability arises from presigned URL signing using secrets hardcoded in the JavaScript of the web app, enabling failure to constrain access to file downloads. An attacker can upload an HTML file and modify the download URL to serve the ...

CVE-2021-41324

CVE-2021-41324 affects Pydio Cells 2.2.9 and involves a directory traversal vulnerability in Copy, Move, and Delete features. A remote authenticated user can enumerate personal files or other users’ files via the nodes parameter (Copy/Move) or the Path parameter (Delete). Root cause is handling o...

CVE-2021-41325

CVE-2021-41325 affects Pydio Cells 2.2.9. It has broken access control allowing remote anonymous users to create standard accounts via the profile parameter, and can grant admin permissions via the Roles parameter. This enables unauthorized account creation and potential privilege elevation. Reme...

CVE-2021-41323

CVE-2021-41323 concerns a directory traversal in the Compress feature of Pydio Cells 2.2.9. The issue allows remote authenticated users to overwrite personal files or others’ files via the format parameter. The vulnerability is documented with CVSS metrics (base score 6.5 CVSS-3.1; 4.0 CVSS-2.0) ...