PT-2025-17202 · Unknown · Pydio Core

Published 2025-04-17 · Updated 2025-04-19 · CVE-2024-40124

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pydio Core versions 8.2.5 and earlier

Description The issue is related to Cross Site Scripting (XSS) via the New URL Bookmark feature. This allows for potential malicious script execution.

Recommendations For Pydio Core versions 8.2.5 and earlier, update to a version later than 8.2.5 to resolve the issue. As a temporary workaround, consider disabling the New URL Bookmark feature until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-40124

Affected Products

Pydio Core

References · 7

• 🔥 https://gist.github.com/Xib3rR4dAr/711195d5793bfbb4364dc179ecaae25d · Exploit
• https://osv.dev/vulnerability/CVE-2024-40124 · Vendor Advisory
• https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-825-hotfix-824 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-40124 · Security Note
• https://twitter.com/CVEnew/status/1913455508704395313 · Twitter Post
• https://t.me/cvedetector/23251 · Telegram Post
• https://t.me/cvetracker/21860 · Telegram Post