CVE-2018-20718

    Dashboard / Vulnerabilities / CVE-2018-20718

    CVE-2018-20718

    Published: 15 Jan 2019Last Modified: 8 Jul 2026

    Summary:

    Details: In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store a preference. An attacker either needs a "public link" of a file, or access to any unprivileged user account for creation of such a link.

    References: https://blog.ripstech.com/2018/pydio-unauthenticated-remote-code-execution/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -87499355dd8666e2885b9f558af4843fce4f82c0

    Affected versions

    pydio-core-8.0.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High