Critical severityNVD Advisory· Published Aug 8, 2025· Updated Apr 15, 2026

CVE-2010-10013

Description

An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rbnvd
sourceforge.net/projects/ajaxplorer/nvd
www.exploit-db.com/exploits/21993nvd
www.tenable.com/plugins/nessus/45489nvd
www.vulncheck.com/advisories/ajaxplorer-unauth-rcenvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.051
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000