CVE-2024-40124

MEDIUM

Pydio <= 8.2.5 - Stored Cross-Site Scripting via New URL Bookmark Feature

Title source: llm

Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature.

Core 2

Core References

Exploit, Third Party Advisory

Patch

CVSS v3 5.4

EPSS 0.0024

EPSS Percentile 14.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-79

Status published

Products (1)

pydio/pydio < 8.2.5

Published Apr 17, 2025

Tracked Since Feb 18, 2026