Server-Side Request Forgery (SSRF)

github.com/pydio/cells is vulnerable to Server-Side Request Forgery (SSRF). The construction of jobs that are executed in the background is possible using Pydio Cells, which allows an attacker to use the remote-download task to make an HTTP GET request to a given URL, save the result to a new file, and then make the file accessible in an attacker-specified folder resulting in sensitive information disclosure.