CVE-2020-12848

In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password and proceed to login to the web application. Once logged into the web application with the hidden user account, some actions that were not available with the public share link can now be performed.

• CWE-287

• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.htmlThird Party Advisory
• https://www.coresecurity.com/advisoriesThird Party Advisory
• https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilitiesExploit, Third Party Advisory
• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.htmlThird Party Advisory
• https://www.coresecurity.com/advisoriesThird Party Advisory
• https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilitiesExploit, Third Party Advisory

Published

Jun 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12841ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12842ismartgate PRO 1.5.9 is vulnerable to privilege escalation b…9.8
• CVE-2020-12843ismartgate PRO 1.5.9 is vulnerable to malicious file uploads…9.8
• CVE-2020-12845Cherokee 0.4.27 to 1.2.104 is affected by a denial of servic…7.5
• CVE-2020-12846Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 a…8
• CVE-2020-12847Pydio Cells 2.0.4 web application offers an administrative c…7.2
• CVE-2020-12849Pydio Cells 2.0.4 allows any user to upload a profile image …5.4
• CVE-2020-1285<p>A remote code execution vulnerability exists in the way t…8.4
• CVE-2020-12850The following vulnerability applies only to the Pydio Cells …7
• CVE-2020-12851Pydio Cells 2.0.4 allows an authenticated user to write or o…8.1
• CVE-2020-12852The update feature for Pydio Cells 2.0.4 allows an administr…6.8
• CVE-2020-12853Pydio Cells 2.0.4 allows XSS. A malicious user can either up…6.1