CVE-2026-76032 | Medium | 4.3 | 2026-08-18 | Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.g… |
CVE-2024-40124 | Medium | 5.4 | 2025-04-17 | Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature. |
CVE-2023-32751 | Medium | 5.4 | 2023-06-08 | Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaSc… |
CVE-2023-32750 | Medium | 6.5 | 2023-06-08 | Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "rem… |
CVE-2023-32749 | High | 8.8 | 2023-06-08 | Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such… |
CVE-2021-41324 | Medium | 6.5 | 2021-09-30 | Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files b… |
CVE-2021-41325 | Medium | 6.5 | 2021-09-30 | Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, su… |
CVE-2021-41323 | Medium | 6.5 | 2021-09-30 | Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any… |
CVE-2020-12850 | High | 7.0 | 2020-06-11 | The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0… |
CVE-2020-12849 | Medium | 5.4 | 2020-06-05 | Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later… |
CVE-2020-12848 | Medium | 5.4 | 2020-06-05 | In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backen… |
CVE-2020-12853 | Medium | 6.1 | 2020-06-04 | Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially malicious HTML and JavaScript code to personal… |
CVE-2020-12852 | Medium | 6.8 | 2020-06-04 | The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update… |
CVE-2020-12851 | High | 8.1 | 2020-06-04 | Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositories) by uploading a… |
CVE-2020-12847 | High | 7.2 | 2020-06-04 | Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console pr… |
CVE-2019-20453 | High | 8.8 | 2020-03-17 | A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownl… |
CVE-2019-20452 | High | 8.8 | 2020-03-17 | A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/Recycle… |
CVE-2013-4267 | Critical | 9.8 | 2020-02-11 | Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS modul… |
CVE-2019-15033 | High | 7.7 | 2019-09-19 | Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, wh… |
CVE-2019-15032 | Medium | 5.3 | 2019-09-19 | Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL… |
CVE-2019-12903 | Medium | 4.3 | 2019-06-20 | Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as… |
CVE-2019-12902 | Medium | 6.5 | 2019-06-20 | Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore… |
CVE-2019-12901 | High | 8.8 | 2019-06-20 | Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an… |
CVE-2019-9642 | Critical | 9.8 | 2019-06-05 | An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by pl… |
CVE-2019-10049 | High | 7.3 | 2019-05-31 | It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared… |
CVE-2019-10048 | High | 7.2 | 2019-05-31 | The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input… |
CVE-2019-10047 | Medium | 5.4 | 2019-05-31 | A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of… |
CVE-2019-10046 | Medium | 5.3 | 2019-05-31 | An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license information. |
CVE-2019-10045 | Medium | 6.5 | 2019-05-31 | The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access… |
CVE-2018-20718 | Critical | 9.8 | 2019-01-15 | In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store a preference. An a… |
CVE-2018-14772 | High | 7.2 | 2018-10-16 | Pydio 4.2.1 through 8.2.1 has an authenticated remote code execution vulnerability in which an attacker with administrator access to the web application can ex… |
CVE-2018-1999018 | Medium | 6.6 | 2018-07-23 | Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScan… |
CVE-2018-1999017 | Medium | 4.9 | 2018-07-23 | Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradeP… |
CVE-2018-1999016 | Medium | 6.1 | 2018-07-23 | Pydio version 8.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./cor… |
CVE-2015-3432 | Medium | 6.1 | 2017-09-19 | Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers to inject arbitrary web script or HTML v… |
CVE-2015-3431 | Critical | 9.8 | 2017-09-19 | Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnera… |
CVE-2013-6227 | | | 2014-12-27 | Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote… |