CVE-2010-10013
Critical
Description
An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.
SeverityCritical
CVSS9.3
Exploit probability—
ProductAjaXplorer
PublishedAug 8, 2025
First seenAug 8, 2025
Weakness typeCWE-78OS command injection
How to fix
Update
- AjaXplorer AjaXplorer2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| AjaXplorer AjaXplorer | v < 2.6 | 2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.