CVE-2019-9642

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created by the guest account, with execution via a proxy.php?hash=../../../../../var/lib/pydio/data/personal/guest/PoC.php request. This is related to plugins/action.share/src/Store/ShareStore.php.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/pydio/pydio-core/commits/develop/core/src/proxy.phpPatch, Third Party Advisory
https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-823-security-releaseRelease Notes, Vendor Advisory
https://github.com/pydio/pydio-core/commits/develop/core/src/proxy.phpPatch, Third Party Advisory
https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-823-security-releaseRelease Notes, Vendor Advisory

Timeline

Published: Jun 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-96445.4An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited CVE-2019-96466.1The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the CVE-2019-96476.1Gila CMS 1.9.1 has XSS.CVE-2019-96485.3An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE co CVE-2019-96495.3An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a dire CVE-2019-96506.1An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event.CVE-2019-96519.8An issue was discovered in SDCMS V1.7. In the \app\admin\controller\themecontroller.php file, the check_bad() function's filtering is not st CVE-2019-96528.8There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parame CVE-2019-96539.8NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharac CVE-2019-96568.8An issue was discovered in LibOFX 0.9.14. There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/o CVE-2019-96577.8Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect p CVE-2019-96585.3Checkstyle before 8.18 loads external DTDs by default.