CVE-2026-85750
HighCVSS 7.2Summary
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, Imagick's support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution. This has been patched in 16.4.0.
Risk Assessment
An attacker can read arbitrary files from the server and execute remote code, potentially leading to full server takeover and data leakage.
Recommendation
Upgrade Piwigo to version 16.4.0 or later. Consider restricting image format handling in the Imagick library.
Other vulnerabilities in Piwigo
See all- CVE-2026-44642High
Piwigo before version 16.4.0: check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials.
- CVE-2026-42324High
Piwigo before version 16.4.0: admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php. When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data.
- CVE-2026-42323High
In Piwigo prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, ratio, and filesize values from the Batch Manager filter URL without numeric validation. These values are stored in the bulk_manager_filter session state and concatenated into SQL predicates, allowing an authenticated administrator to inject SQL expressions. The issue is fixed in version 16.4.0.
- CVE-2017-17827High
Piwigo version 2.9.2 is vulnerable to Cross-Site Request Forgery (CSRF) via specific URL parameters. An attacker can coerce an admin user into performing unintended actions.
- CVE-2017-17774High
The admin/configuration.php file in Piwigo version 2.9.2 has a CSRF (Cross-Site Request Forgery) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
- CVE-2017-10681High
CVE-2017-10681 in Piwigo through 2.9.1 has a CSRF vulnerability that allows remote attackers to hijack user authentication for requests to unlock albums via a crafted request.
- CVE-2017-10680High
CVE-2017-10680 is a CSRF vulnerability in Piwigo through version 2.9.1 that allows remote attackers to hijack user authentication to change a private album to public via a crafted request.
- CVE-2017-10679High
Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.
- CVE-2017-10678High
The CSRF vulnerability in Piwigo through version 2.9.1 allows remote attackers to hijack user authentication for requests to delete permalinks via a crafted request.
- CVE-2016-10084High
The admin/batch_manager.php file in Piwigo up to version 2.8.3 has a vulnerability that allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).
Original NVD description (English source)
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS