Path Traversal in Piwigo Image Derivative Handler

Executive Summary

CVE-2026-84441 is a path traversal vulnerability in Piwigo versions up to 16.3.0. It exists in the i.php file, where a user-controlled path from the URL is improperly validated, allowing attackers to use sequences like '..' to escape the intended directory. This enables writing derivative images outside the cache location without authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the i.php endpoint with unusual path parameters containing dot-dot-slash (../) sequences. Check Piwigo logs for unauthorized file writes outside the _data/i/ directory. Use tools like curl to test if the server allows path traversal by requesting a local image with a manipulated path.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to create malicious directory structures and write files to unintended locations in the Piwigo installation. This may lead to unauthorized file access, potential code execution, or disruption of the application's integrity. The impact depends on server permissions and configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. If exploited, it may result in data breaches, unauthorized modifications, or loss of audit integrity, potentially leading to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Piwigo to a version beyond 16.3.0. If upgrading is not possible, restrict access to the i.php endpoint via firewall rules or disable derivative image generation. Review and remove any unauthorized files written outside the intended directories.

Useful 0 Not Useful 0