CVE-2025-62512mediumCWE-204

CVE-2025-62512: medium-severity vulnerability in Piwigo

Piwigo Vulnerable to User Enumeration via Password Reset Endpoint

Published · Updated

28Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 5.5epss 0.8%
exploitation probability
0.8%top 45% of all CVEs
observed exploitation
nono source reports it
In short

Piwigo's password reset feature leaks information about which usernames and emails exist in the system. An attacker can test many accounts without needing to log in, making it easier to target specific users.

Technical detail

The password reset endpoint (password.php?action=lost) in Piwigo 15.5.0 and earlier generates different responses for existing versus non-existent accounts, allowing unauthenticated enumeration of valid usernames and email addresses. This information disclosure (CWE-204) has a CVSS score of 5.5 and facilitates subsequent targeted attacks such as credential stuffing or phishing.

Summary generated and translated by AI from the official description.
Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Piwigo · Piwigo
Related CVEs — Piwigo

In the same product, most dangerous first.

CVE-2023-37270HIGHPiwigo SQL Injection vulnerability in "User-Agent"EPSS 4.5%CVE-2026-27833HIGHPiwigo: Unauthenticated Information Disclosure via pwg.history.search APIEPSS 1.7%CVE-2023-44393CRITICALPiwigo Reflected XSS vulnerabilityEPSS 1.3%CVE-2026-44642HIGHPiwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)EPSS 1.3%CVE-2026-85750HIGHPiwigo arbitrary file read and remote code execution via insecure image processingEPSS 1.2%CVE-2026-42324HIGHPiwigo: Second-Order SQL InjectionEPSS 0.9%
References
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc