by Kastro
Paper/Archive/CVE-2026-42322

CVE-2026-42322

Piwigo Piwigo — Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

EPSS 1%public exploitCVSS 9.1
critical.is priorityof 100
51
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 70.0.700 × 2014.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.

Affected

ProductAffectedFixed inSource
Piwigo< 16.4.0–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvvrefgithub.com/Piwigo/Piwigo/commit/1e7f7262cb30e6916779f93e66d5d6579ec75a11refgithub.com/Piwigo/Piwigo/commit/4a13ec9a8f4881ae1f23bdfd24d7b90cd0802cdcrefgithub.com/Piwigo/Piwigo/releases/tag/16.4.0