Read the docs
TI-2026-30629 Aliases CVE-2026-42322

Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

Priority HIGH 74CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01278 70th percentileScored 2026-11-07
Fix Fixed Piwigo (Piwigo): 16.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PiwigoPiwigobefore 16.4.016.4.0Patch availableCNA
  • Piwigo VendorPiwigo Affected before 16.4.0 Fixed in 16.4.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*——Piwigo
  • cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:* Versions — — ·Piwigo

Remediation

  • Fix · CNA Piwigo (Piwigo) Fixed in 16.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42322
  2. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 4

  • TI-2026-27251 Piwigo RCE via PHP Code Injection into Config File in Installer CVSS 3.1CRITICAL 9.8
  • TI-2023-16500 Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. CVSS 3.1CRITICAL 9.8
  • TI-2026-44470 Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create` CVSS 3.1CRITICAL 9.1
  • TI-2023-16499 Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. CVSS 3.1CRITICAL 9.8
  • TI-2023-23899 Piwigo Reflected XSS vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2025-38673 Piwigo is vulnerable to one-click account takeover by modifying the password-reset link CVSS 3.1HIGH 8.8
See all 120 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences