CVE-2026-42322

Deferred Deferred - Pending Action

Authenticated File Upload RCE in Piwigo Photo Gallery

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-42322

EUVD

EUVD-2026-87139

Affected Vendors & Products

Vendor	Product	Version / Range
piwigo	piwigo	to 16.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

Piwigo versions before 16.4.0 have a flaw in admin/themes_standard_pages.php where uploaded logos are validated by MIME type but the filename extension is attacker-controlled. This allows an authenticated admin to upload a file with a malicious extension that executes when accessed, leading to arbitrary command execution and other attacks.

Detection Guidance

Check for unauthorized files in the Piwigo logo directory with executable extensions like .php, .jsp, or .asp. Review server logs for unexpected requests to logo files with non-image extensions.

Impact Analysis

An attacker with admin access could upload a malicious file that executes on the server, enabling full system compromise. This could result in data theft, unauthorized modifications, service disruption, or persistent backdoors in the photo gallery application.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating GDPR's integrity and confidentiality principles and HIPAA's safeguards for protected health information. Organizations may face compliance violations and penalties if exploited.

Mitigation Strategies

Upgrade Piwigo to version 16.4.0 or later immediately. Remove any suspicious files in the logo directory and audit user uploads for malicious extensions.

Hi! I’m here to help you understand CVE-2026-42322. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70