CVE-2016-10105

Critical

Published: 03/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The admin/plugin.php file in Piwigo up to version 2.8.3 does not validate the sections variable when using it to include files. This can lead to information disclosure and code execution if it contains a .. sequence.

Risk Assessment

The organization may be exposed to sensitive information disclosure and remote code execution, potentially leading to serious security breaches.

Recommendation

It is recommended to update Piwigo to the latest version that fixes this vulnerability and to implement additional input validation mechanisms.

Original NVD description (English source)

admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.