CVE-2020-12851

Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositories) by uploading a custom generated ZIP file and leveraging the file extraction feature present in the web application. The extracted files will be placed in the targeted user folders.

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0 NVD

5.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N

EPSS

1.45% chance of exploitation in the next 30 days, 73rd percentile

Published

2020-06-04

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities

Security advisories

• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Executi…
• https://www.coresecurity.com/advisories

References

• CVE Record
• NVD entry