CVE-2020-12853: 
NixOS vulnerability analysis and mitigation

Pydio Cells 2.0.4 contains a Cross-Site Scripting (XSS) vulnerability identified as CVE-2020-12853. The vulnerability was discovered in June 2020 and affects the file handling functionality of the application. A malicious user can exploit this vulnerability by either uploading or creating a new file containing potentially malicious HTML and JavaScript code to personal folders or accessible cells (Core Labs, NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability exists due to improper validation of user-supplied content in files that can be uploaded to the system. When these files are accessed, the malicious HTML and JavaScript code they contain is executed in the context of other users' sessions (NVD).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' sessions who access the malicious files. This can lead to theft of session tokens, credential theft, and other client-side attacks against application users (Core Labs).

The vulnerability is exploitable by authenticated users who can upload or create files in the system. The attacker needs to create a file containing malicious HTML and JavaScript code and trick other users into accessing it. Proof-of-concept exploits have been publicly documented (Core Labs).

The vulnerability has been fixed in Pydio Cells version 2.0.7. Users are advised to upgrade to this version or later to address the security issue (Core Labs).