CVE-2020-12852

The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating its checksum and signature with the provided public key and finally replacing the current application binary. To complete the update process, the application’s service or appliance needs to be restarted. An attacker with administrator access can leverage the software update feature to force the application to download a custom binary that will replace current Pydio Cells binary. When the server or service is eventually restarted the attacker will be able to execute code under the privileges of the user running the application. In the Pydio Cells enterprise appliance this is with the privileges of the user named “pydio”.

• CWE-20

• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.htmlThird Party Advisory
• https://www.coresecurity.com/advisoriesThird Party Advisory
• https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilitiesExploit, Third Party Advisory
• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.htmlThird Party Advisory
• https://www.coresecurity.com/advisoriesThird Party Advisory
• https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilitiesExploit, Third Party Advisory

Published

Jun 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12847Pydio Cells 2.0.4 web application offers an administrative c…7.2
• CVE-2020-12848In Pydio Cells 2.0.4, once an authenticated user shares a fi…5.4
• CVE-2020-12849Pydio Cells 2.0.4 allows any user to upload a profile image …5.4
• CVE-2020-1285<p>A remote code execution vulnerability exists in the way t…8.4
• CVE-2020-12850The following vulnerability applies only to the Pydio Cells …7
• CVE-2020-12851Pydio Cells 2.0.4 allows an authenticated user to write or o…8.1
• CVE-2020-12853Pydio Cells 2.0.4 allows XSS. A malicious user can either up…6.1
• CVE-2020-12854A remote code execution vulnerability was identified in SecZ…8.8
• CVE-2020-12855A Host header injection vulnerability has been discovered in…8.8
• CVE-2020-12856OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogeth…9.8
• CVE-2020-12857Caching of GATT characteristic values (TempID) in COVIDSafe …7.5
• CVE-2020-12858Non-reinitialisation of random data in the advertising paylo…7.5