{"cve":"CVE-2019-10047","nvd":{"published":"2019-05-31T22:29:01.050","modified":"2026-06-17T02:10:05.993","status":"Modified","description":"A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be used to access the uploaded file. If a malicious user shares an uploaded HTML file containing JavaScript code with another user of the application, and tricks an authenticated victim into accessing a URL that results in the HTML code being interpreted by the web browser, then the included JavaScript code is executed under the context of the victim user session.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4},"cwes":["CWE-79"],"references":["https://www.secureauth.com/labs/advisories","https://www.secureauth.com/labs/advisories"],"products":["pydio:pydio"],"source":"nvd","synced_at":"2026-10-19T20:57:00.690689396+00:00"},"epss":{"cve":"CVE-2019-10047","score":0.00668,"percentile":0.51921,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-5ghg-233h-7j79","url":"https://osv.dev/vulnerability/GHSA-5ghg-233h-7j79","summary":"PyDio Stored XSS Vulnerability","modified":"2026-07-07T11:56:17.514131603Z","packages":[{"ecosystem":"PyPI","name":"pydio","purl":"pkg:pypi/pydio","ranges":["<=8.2.2"],"fixed":[]}]},{"id":"PYSEC-2026-902","url":"https://osv.dev/vulnerability/PYSEC-2026-902","summary":"PyDio Stored XSS Vulnerability","modified":"2026-07-07T11:45:21.894788636Z","packages":[{"ecosystem":"PyPI","name":"pydio","purl":"pkg:pypi/pydio","ranges":["<=8.2.2"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}