Description
In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store a preference. An attacker either needs a "public link" of a file, or access to any unprivileged user account for creation of such a link.
Exploits (1)
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://blog.ripstech.com/2018/pydio-unauthenticated-remote-code-execution/
Scores
CVSS v3
9.8
EPSS
0.0939
EPSS Percentile
92.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-502
Status
published
Products (1)
pydio/pydio
< 8.2.2
Published
Jan 15, 2019
Tracked Since
Feb 18, 2026