{"id":"CVE-2018-1999016","details":"Pydio version 8.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating the web client via XSS code injection. This attack appear to be exploitable via the victim openning a specially crafted URL. This vulnerability appears to have been fixed in version 8.2.1.","modified":"2026-07-08T16:40:11.869088Z","published":"2018-07-23T15:29:00.547Z","references":[{"type":"FIX","url":"https://pydio.com/en/community/releases/pydio-core/pydio-821-security-release"},{"type":"EVIDENCE","url":"https://www.mike-gualtieri.com/files/Pydio-8-VulnerabilityDisclosure-Jul18.txt"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pydio/pydio-core","events":[{"introduced":"0"},{"last_affected":"7dcdf8dd51636df8f9613db315e1c69eebc98ef8"}],"database_specific":{"cpe":"cpe:2.3:a:pydio:pydio:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"8.2.0"}],"source":"CPE_RANGE"}}],"versions":["pydio-core-8.2.0","pydio-core-8.0.1","pydio-core-7.0.3","pydio-core-7.0.2","pydio-core-6.4.2","pydio-core-6.4.2rc1","pydio-core-6.4.1","pydio-core-6.4.0","pydio-core-6.4.0rc3","pydio-core-6.4.0rc2","pydio-core-6.4.0rc1","pydio-core-6.2.2","pydio-core-6.3.1","pydio-core-6.2.2rc3","pydio-core-6.2.2rc2","pydio-core-6.2.2rc","pydio-core-6.2.1","pydio-core-6.2.0","6.2rc","pydio-core-6.0.8","pydio-core-6.0.7","pydio-core-5.2.5","pydio-core-6.0.6","pydio-core-6.0.5","pydio-core-6.0.4","pydio-core-6.0.3","pydio-core-6.0.2","pydio-core-6.0.1","pydio-core-6.0.0","pydio-core-5.2.4","pydio-core-5.2.3","pydio-core-5.2.2","pydio-core-5.2.1","pydio-core-5.2.0","pydio-core-5.1.1","pydio-core-5.1.0","ajaxplorer-core-5.0.2","ajaxplorer-core-5.0.1","ajaxplorer-core-5.0.0","ajaxplorer-core-4.3.4","ajaxplorer-core-4.3.3","ajaxplorer-core-4.3.2","ajaxplorer-core-4.3.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1999016.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}