CVE-2013-6226: Directory traversal vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (f...

Security readout for executives and security teams

This issue affects the Zoho editor plugin in older Pydio/AjaXplorer installations. A remote attacker could abuse a directory traversal flaw to read or delete files outside the intended area. That can expose sensitive data or disrupt service, especially if the affected file-sharing system is internet-facing. Most likely exposure is legacy Pydio/AjaXplorer deployments before 5.0.4 with the Zoho editor plugin installed and reachable. The source bundle does not identify newer affected versions, default plugin state, authentication requirements, or specific deployment conditions. Prioritize remediation for any internet-facing or sensitive file-sharing deployment. Arbitrary file read and delete capability can create confidentiality and availability impact, even though active exploitation is not established in the provided sources. Mitigation focus: Upgrade affected Pydio/AjaXplorer installations to 5.0.4 or follow current vendor guidance.; Disable or remove the Zoho editor plugin if upgrade timing is uncertain.; Restrict access to the Pydio application and administrative interfaces..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.