Remote Code Execution Vulnerability in Pydio Cells by Pydio

CVE-2020-12852

What is CVE-2020-12852?

The Pydio Cells 2.0.4 update feature allows administrators to define a custom update URL and specify a public RSA key for validating updates. An attacker with administrative access can exploit this by directing the software to download a malicious binary instead of the legitimate update. Upon application restart, this unauthorized code executes with the privileges of the application user, allowing attackers to gain control over the system.

References