What’s Vulnerable › Vulnerabilities

CVE-2019-15033

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-19 · updated 2026-06-17
• Weakness: CWE-918

Description

Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, when sending a file to a remote server, as demonstrated by the file=http%3A%2F%2F192.168.1.2 substring.

Affected products

• Pydio: 6.0.8

References

• https://heitorgouvea.me/2019/09/17/CVE-2019-15033
• https://pydio.com
• https://sourceforge.net/projects/ajaxplorer/files/pydio/stable-channel/
• https://heitorgouvea.me/2019/09/17/CVE-2019-15033
• https://pydio.com
• https://sourceforge.net/projects/ajaxplorer/files/pydio/stable-channel/

Get alerted when CVE-2019-15033 or the next vulnerability affects your stack