CVE-2026-42322 Details
Description
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.
A remote code execution vulnerability has been identified in Piwigo versions 16.2.0 through 17.0.0beta1. The issue arises in the logo upload feature within the admin panel, where file validation is inadequate. The application relies on MIME type checking without enforcing strict validation of file extensions. This flaw allows authenticated administrators to upload malicious files that can be executed by the server. Exploitation involves uploading a file with a server-executable extension, which is then executed when accessed through the web server.
Users can upgrade to Piwigo version 16.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Piwigo/Piwigo/commit/1e7f7262cb30e6916779f93e66d5d6579ec75a11 | [email protected] | Source CodeVendor |
| https://github.com/Piwigo/Piwigo/commit/4a13ec9a8f4881ae1f23bdfd24d7b90cd0802cdc | [email protected] | Source CodeVendor |
| https://github.com/Piwigo/Piwigo/releases/tag/16.4.0 | [email protected] | Vendor |
| https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Piwigo | >= 16.2.0, <= 17.0.0beta1 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | New CVE Received | [email protected] |