CVE-2019-10047

Vulnerability

Description A stored cross-site scripting (XSS) vulnerability exists in Pydio versions through 8.2.2. The flaw resides in the file upload and file preview features. An authenticated attacker can upload an HTML file containing malicious JavaScript code. When another authenticated victim accesses a file preview URL for the uploaded file, the HTML is rendered and the JavaScript executes in the context of the victim's session [2].

Exploitation

Exploitation requires an authenticated attacker to upload a crafted HTML file and then share the file with a victim. The victim must be authenticated to the Pydio application and click on a preview link for the malicious file. No additional privileges are needed beyond basic user authentication [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, data theft, or performing actions on behalf of the victim within the Pydio application [2].

Mitigation

Pydio has not released an official patch statement, but users are advised to upgrade to a version beyond 8.2.2 (such as Pydio Cells) which likely addresses this issue. Until then, avoid clicking on preview links for HTML files from untrusted users.