Abstrium Pydio Cells User Creation resource injection

published 2023-05-30 3 y ago modified 2026-06-17 4 mo ago also GHSA-j327-c69h-4gh8 , GO-2023-2344 , EUVD-2023-1562

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.

Patch / fix

fixed in 1 links 1

go github.com/pydio/cells/v4 4.2.1

pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-4… patch

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 21 mo ago (2025-01-10)

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

popalltheshells.medium.com https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
go	github.com/pydio/cells/v4	<4.2.1	4.2.1
go	github.com/pydio/cells	all versions	no fix listed

Affected products

Abstrium Pydio Cells

Classification

Weakness

CWE-99 Improper Control of Resource Identifiers
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

pydio.com /en/community/releases/pydio-cells/pydio-cells-enterprise-421
patch, web, release-notes
popalltheshells.medium.com /multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be
exploit, web, third-party-advisory
vuldb.com /?id.230212
vdb-entry, technical-description, web, permissions-required, third-party-advisory
vuldb.com /?ctiid.230212
signature, permissions-required, web, third-party-advisory, vdb-entry
nvd.nist.gov /vuln/detail/CVE-2023-2980
advisory
github.com /pydio/cells
package
github.com /advisories/GHSA-j327-c69h-4gh8
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary