CVE-2026-78187
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability has been found in Piwigo 16.3.0 in an unknown function of the Public Authentication Page component. Manipulation of the lang argument leads to cross site scripting. The attack may be performed remotely, but is difficult to exploit. The exploit has been disclosed. Upgrading to version 16.4.0 fixes this issue.
Risk Assessment
A remote attacker can exploit XSS to execute scripts in the victim's browser, potentially leading to session theft, account takeover, or other malicious actions. The public exploit increases the risk.
Recommendation
It is recommended to immediately update Piwigo to version 16.4.0, which contains the fix. Also inform users about the risk and monitor logs.
Other vulnerabilities in Piwigo
See all- CVE-2017-17827High
Piwigo version 2.9.2 is vulnerable to Cross-Site Request Forgery (CSRF) via specific URL parameters. An attacker can coerce an admin user into performing unintended actions.
- CVE-2017-17774High
The admin/configuration.php file in Piwigo version 2.9.2 has a CSRF (Cross-Site Request Forgery) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
- CVE-2017-10681High
CVE-2017-10681 in Piwigo through 2.9.1 has a CSRF vulnerability that allows remote attackers to hijack user authentication for requests to unlock albums via a crafted request.
- CVE-2017-10680High
CVE-2017-10680 is a CSRF vulnerability in Piwigo through version 2.9.1 that allows remote attackers to hijack user authentication to change a private album to public via a crafted request.
- CVE-2017-10679High
Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.
- CVE-2017-10678High
The CSRF vulnerability in Piwigo through version 2.9.1 allows remote attackers to hijack user authentication for requests to delete permalinks via a crafted request.
- CVE-2016-10084High
The admin/batch_manager.php file in Piwigo up to version 2.8.3 has a vulnerability that allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).
- CVE-2015-1441High
SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2014-9115High
SQL injection vulnerability in the rate_picture function in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.
- CVE-2014-4648High
Unspecified vulnerability in Piwigo before version 2.6.3 has unknown impact and attack vectors, related to a 'security failure.'
Original NVD description (English source)
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 16.4.0 will fix this issue. The name of the patch is 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e. It is recommended to upgrade the affected component.