CVE-2010-10013: An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the…

PriorityP272critical9.3CVSS 4.0

AVNACLATNPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX

EXPLOIT

EPSS

1.08%

60.8th percentile

An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
ajaxplorer	ajaxplorer	< 2.6	2.6

Detection & IOCsextracted from sources · hover to see the quote

path/plugins/access.ssh/checkInstall.php↗

url/plugins/access.ssh/checkInstall.php?destServer=↗

→Monitor HTTP GET requests targeting checkInstall.php within the access.ssh plugin path for shell metacharacter injection in the destServer parameter ↗
→A Metasploit module exists for this vulnerability; look for exploit framework signatures or automated scanning patterns against the checkInstall.php endpoint ↗
→Unauthenticated requests to checkInstall.php should be treated as suspicious; no authentication is required to trigger the vulnerability ↗

·Vulnerability only affects AjaXplorer (Pydio Cells) versions strictly prior to 2.6; version 2.6 and later are not affected ↗
·Commands execute with web server process privileges, not necessarily root; scope of impact depends on web server user configuration ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.