Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-85750 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.8 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:7.2 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw	CISA-ADP	AdvisoryExploitRemedyVendor
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw	[email protected]	AdvisoryExploitRemedyVendor
https://www.helx.io/en/blog/advisory-piwigo	[email protected]	AdvisoryRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-20	Improper Input Validation	[email protected]

Affected Products

Product	Versions
Piwigo	<= 16.3.0 (semver)
CPE cpe:2.3:a:piwigo:piwigo:::::::: Remediation Upgrade: 16.4.0moderate effort Workaround:low effort Disable the Imagick library and use GD for image processing instead. Mitigation:low effort Enforce strict file type validation by verifying both MIME type and file signature (magic bytes) to ensure that uploaded files genuinely match their declared format. Mitigation:low effort Sanitize SVG files before processing by using a dedicated sanitization library to strip unsafe elements (e.g., external references, scripts) and block inclusion of local or remote resources within SVG content. Mitigation:low effort Harden the Imagick security policy (policy.xml) to disable or restrict risky coders and features (such as SVG and MSL) and limit file system access to reduce the attack surface during image processing.

Product

Versions

Piwigo

<= 16.3.0 (semver)

CPE

cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*

Remediation

Upgrade: 16.4.0moderate effort
Workaround:low effort
Disable the Imagick library and use GD for image processing instead.
Mitigation:low effort
Enforce strict file type validation by verifying both MIME type and file signature (magic bytes) to ensure that uploaded files genuinely match their declared format.
Mitigation:low effort
Sanitize SVG files before processing by using a dedicated sanitization library to strip unsafe elements (e.g., external references, scripts) and block inclusion of local or remote resources within SVG content.
Mitigation:low effort
Harden the Imagick security policy (policy.xml) to disable or restrict risky coders and features (such as SVG and MSL) and limit file system access to reduce the attack surface during image processing.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 25, 2026	CVE Modified	CISA-ADP
Sep 25, 2026	New CVE Received	[email protected]