What’s Vulnerable › Vulnerabilities

CVE-2023-32751

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-08 · updated 2026-06-17
• Weakness: CWE-79

Description

Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript [1]. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it is possible to generate valid signatures for arbitrary download URLs. By uploading an HTML file and modifying the download URL to serve the file inline instead of as an attachment, any included JavaScript code is executed when the URL is opened in a browser, leading to a cross-site scripting vulnerability.

Affected products

• pydio cells: before 3.0.12; from 4.1.0 before 4.1.3 — fixed in 3.0.12, 4.1.3

How to fix

Upgrade to a fixed version: pydio cells 3.0.12, 4.1.3. Check the vendor advisory for mitigations.

References

• https://www.redteam-pentesting.de/advisories/rt-sa-2023-004/
• https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
• https://www.redteam-pentesting.de/advisories/rt-sa-2023-004/
• https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses

Get alerted when CVE-2023-32751 or the next vulnerability affects your stack