CVE-2020-12849

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user.

• CWE-79

• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.htmlExploit, Third Party Advisory
• https://www.coresecurity.com/advisoriesThird Party Advisory
• https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilitiesThird Party Advisory
• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.htmlExploit, Third Party Advisory
• https://www.coresecurity.com/advisoriesThird Party Advisory
• https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilitiesThird Party Advisory

Published

Jun 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12842ismartgate PRO 1.5.9 is vulnerable to privilege escalation b…9.8
• CVE-2020-12843ismartgate PRO 1.5.9 is vulnerable to malicious file uploads…9.8
• CVE-2020-12845Cherokee 0.4.27 to 1.2.104 is affected by a denial of servic…7.5
• CVE-2020-12846Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 a…8
• CVE-2020-12847Pydio Cells 2.0.4 web application offers an administrative c…7.2
• CVE-2020-12848In Pydio Cells 2.0.4, once an authenticated user shares a fi…5.4
• CVE-2020-1285<p>A remote code execution vulnerability exists in the way t…8.4
• CVE-2020-12850The following vulnerability applies only to the Pydio Cells …7
• CVE-2020-12851Pydio Cells 2.0.4 allows an authenticated user to write or o…8.1
• CVE-2020-12852The update feature for Pydio Cells 2.0.4 allows an administr…6.8
• CVE-2020-12853Pydio Cells 2.0.4 allows XSS. A malicious user can either up…6.1
• CVE-2020-12854A remote code execution vulnerability was identified in SecZ…8.8