CVE-2020-12850

The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0.3) have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the appliance, the user pydio is responsible for running all the services and binaries that are contained in the Pydio Cells web application package, such as mysqld, cells, among others. This user has privileges restricted to run those services and nothing more.

• CWE-269

• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://www.coresecurity.com/advisoriesThird Party Advisory
• https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilitiesExploit, Third Party Advisory
• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://www.coresecurity.com/advisoriesThird Party Advisory
• https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilitiesExploit, Third Party Advisory

Published

Jun 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12845Cherokee 0.4.27 to 1.2.104 is affected by a denial of servic…7.5
• CVE-2020-12846Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 a…8
• CVE-2020-12847Pydio Cells 2.0.4 web application offers an administrative c…7.2
• CVE-2020-12848In Pydio Cells 2.0.4, once an authenticated user shares a fi…5.4
• CVE-2020-12849Pydio Cells 2.0.4 allows any user to upload a profile image …5.4
• CVE-2020-1285<p>A remote code execution vulnerability exists in the way t…8.4
• CVE-2020-12851Pydio Cells 2.0.4 allows an authenticated user to write or o…8.1
• CVE-2020-12852The update feature for Pydio Cells 2.0.4 allows an administr…6.8
• CVE-2020-12853Pydio Cells 2.0.4 allows XSS. A malicious user can either up…6.1
• CVE-2020-12854A remote code execution vulnerability was identified in SecZ…8.8
• CVE-2020-12855A Host header injection vulnerability has been discovered in…8.8
• CVE-2020-12856OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogeth…9.8