Code execution via attacker-controlled update signing key

Improper input validation in Pydio Cells 2.0.4 allows remote authenticated users with administrator access to execute code after a restart. The Cells Console accepts both a custom update-server URL and the RSA public key that validates the response, allowing a signed attacker-controlled binary to replace the application executable. Administrator access and a later service or appliance restart are required; code then runs with the application account's privileges, including the pydio account on the enterprise appliance.