Read the docs
TI-2026-58834 Aliases CVE-2026-85750

Piwigo arbitrary file read and remote code execution via insecure image processing

Priority HIGH 67CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01207 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PiwigoPiwigoup to 16.3.0—No fix listedCNA
  • Piwigo VendorPiwigo Affected up to 16.3.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*——Piwigo
  • cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:* Versions — — ·Piwigo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85750

References

Other 2

  • TI-2026-27251 Piwigo RCE via PHP Code Injection into Config File in Installer CVSS 3.1CRITICAL 9.8
  • TI-2023-16500 Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. CVSS 3.1CRITICAL 9.8
  • TI-2026-44470 Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create` CVSS 3.1CRITICAL 9.1
  • TI-2023-16499 Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. CVSS 3.1CRITICAL 9.8
  • TI-2023-23899 Piwigo Reflected XSS vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2026-30629 Piwigo: Authenticated RCE via File Upload in Logo Upload Feature CVSS 3.1CRITICAL 9.1
See all 120 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences