CVE-2019-20453: Pydio

High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days.

A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.

Affected products

• Pydio Pydio: before 8.2.4 (fixed in 8.2.4)

Published 2020-03-17. Last modified 2026-06-17.