CVE-2019-20452

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-17 · updated 2026-06-17
Weakness: CWE-502

Description

A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.

Affected products

Pydio: before 8.2.4 — fixed in 8.2.4

How to fix

Upgrade to a fixed version: Pydio 8.2.4. Check the vendor advisory for mitigations.

References

https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release
https://www.certilience.fr/2020/03/cve-2019-20452-vulnerabilite-php-object-injection-pydio-core/
https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release
https://www.certilience.fr/2020/03/cve-2019-20452-vulnerabilite-php-object-injection-pydio-core/

Get alerted when CVE-2019-20452 or the next vulnerability affects your stack