CVE-2026-85750
Deferred Deferred - Pending Action

Arbitrary File Read and RCE in Piwigo via Imagick

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-16
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-85750
EUVD
EUVD-2026-87094

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
piwigo piwigo to 16.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Piwigo before version 16.4.0 has a flaw in image upload handling when using the Imagick library. Attackers can exploit insufficient validation to read arbitrary files or execute remote code by disguising malicious content as image files. This includes format confusion attacks like embedding SVG content in PNG files or abusing Imagick's scripting features to run unauthorized commands on the server.

Detection Guidance

Check Piwigo version with: grep -r 'Piwigo' /var/www/html/ | grep 'version'. Look for Imagick library usage in PHP with: php -i | grep -i imagick. Monitor for unexpected file reads or uploads in web server logs.

Impact Analysis

If you use Piwigo with Imagick enabled, an attacker could steal sensitive files from your server, modify or delete data, or take full control of your system. This could lead to data breaches, defacement of your website, or unauthorized access to user information stored on the server.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information if medical data is stored on the affected system. Both standards require safeguards against unauthorized access, which this flaw undermines.

Mitigation Strategies

Upgrade Piwigo to v16.4.0 or later immediately. Disable Imagick library if not required. Restrict file uploads to trusted formats only. Implement strict file type validation for uploads. Review server permissions to prevent unauthorized file writes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85750. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart