CVE-2026-42322

CRITICAL 9.1

Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.

CWE	CWE-434
Vendor	piwigo
Product	piwigo
Published	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for piwigo piwigo

Be the first to know when new critical vulnerabilities affecting piwigo piwigo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Piwigo / Piwigo

< 16.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv github.com: https://github.com/Piwigo/Piwigo/commit/1e7f7262cb30e6916779f93e66d5d6579ec75a11 github.com: https://github.com/Piwigo/Piwigo/commit/4a13ec9a8f4881ae1f23bdfd24d7b90cd0802cdc github.com: https://github.com/Piwigo/Piwigo/releases/tag/16.4.0