CVE-2019-12901: Pydio Cells

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation.

Affected products

• Pydio Cells: before 1.5.0 (fixed in 1.5.0)

Published 2019-06-20. Last modified 2026-06-17.