Skip to content
OpenAdvisories

Vendor

Piwigo

18 known vulnerabilities.

Products

Piwigo 18
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-42322 Public exploit

    Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

    Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the sto…

    Piwigo Piwigo
  • Critical 9.1
    CVE-2026-62262

    Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`

    Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned searc…

    Piwigo Piwigo
  • Critical 9.8
    CVE-2026-35048

    Piwigo RCE via PHP Code Injection into Config File in Installer

    The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks f…

    Piwigo Piwigo
  • Critical 9.3
    CVE-2023-44393 Scanner template

    Piwigo Reflected XSS vulnerability

    Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by a…

    Piwigo Piwigo