Piwigo Public Authentication cross site scripting
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.
Summary
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 16.4.0 will fix this issue. The name of the patch is 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e. It is recommended to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Piwigo | 16.3.0 | 16.4.0 | Patch available | CNA |
- Piwigo Vendor— Affected 16.3.0 Fixed in 16.4.0 Patch available CNA
Remediation
- Fix · CNA Piwigo Fixed in 16.4.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-78187
- 2026-10-03 Alias added: GHSA-p4vh-hfqq-9prq
- 2026-10-11 EPSS moved to the 50th–90th percentile
References
Patch 2
Sources
- CVE-2026-78187 · CVE Program
- CVE-2026-78187 · NVD
- FIRST EPSS
- GHSA-p4vh-hfqq-9prq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences