CVE-2026-42322criticalCWE-434

CVE-2026-42322: critical vulnerability in Piwigo

Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

Published · Updated

Follow this CVE+ Monitor Piwigo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.1epss 1.3%
from disclosure to weapon7 days
Published on NVDSep 25
1st PoC+7d
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Piwigo · Piwigo
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Piwigo

In the same product, most dangerous first.

CVE-2023-37270HIGHPiwigo SQL Injection vulnerability in "User-Agent"EPSS 4.5%CVE-2026-27833HIGHPiwigo: Unauthenticated Information Disclosure via pwg.history.search APIEPSS 1.6%CVE-2023-44393CRITICALPiwigo Reflected XSS vulnerabilityEPSS 1.3%CVE-2026-44642HIGHPiwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)EPSS 1.3%CVE-2026-85750HIGHPiwigo arbitrary file read and remote code execution via insecure image processingEPSS 1.2%CVE-2026-42324HIGHPiwigo: Second-Order SQL InjectionEPSS 0.9%