Critical severityNVD Advisory· Published Aug 8, 2025· Updated Apr 15, 2026

CVE-2010-10013

Description

An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ajaxplorer/Pydio Cellsllm-create
Range: <2.6

Patches

Vulnerability mechanics

References

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rbnvd
sourceforge.net/projects/ajaxplorer/nvd
www.exploit-db.com/exploits/21993nvd
www.tenable.com/plugins/nessus/45489nvd
www.vulncheck.com/advisories/ajaxplorer-unauth-rcenvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.001
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000