CVE-2025-62406

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description

Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-11-25

Generated

2026-07-06

AI Q&A

2025-11-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62406

EUVD

EUVD-2025-198100

Affected Vendors & Products

Vendor	Product	Version / Range
piwigo	piwigo	15.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

This vulnerability in Piwigo 15.6.0 involves the password reset function, which sends a password-reset URL based on the HTTP request's Host header without validating it. An attacker can exploit this by modifying the hostname in the URL sent to a user whose username or email is known or guessed, potentially redirecting the user to a malicious site.

Impact Analysis

The vulnerability can lead to phishing attacks where users receive password reset links with malicious hostnames, potentially allowing attackers to steal credentials or reset passwords unauthorizedly. This compromises confidentiality and integrity of user accounts.

Mitigation Strategies

Upgrade Piwigo to version 15.7.0 or later, where this vulnerability has been patched. Until the upgrade is applied, consider restricting access to the password reset function or monitoring for suspicious password reset requests that may exploit the Host header manipulation.

Hi! I’m here to help you understand CVE-2025-62406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70