Piwigo vulnerabilities
We track 16 vulnerabilities in Piwigo products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on September 25, 2026.
Latest Piwigo vulnerabilities
- 9.1 Critical severity
Piwigo: Improper Neutralization of Special Elements used in an SQL Command
Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search
- 8.1 High severity
Piwigo: Improper Neutralization of Special Elements used in an SQL Command
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function
- 7.2 High severity
Piwigo: Improper Neutralization of Special Elements used in an SQL Command
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order exp
- 7.2 High severity
Piwigo: Improper Neutralization of Special Elements used in an SQL Command
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numer
- 9.1 Critical severity
Piwigo: Unrestricted Upload of File with Dangerous Type
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stor
- 7.2 High severity
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image…
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., d
- 7.3 High severity
Piwigo: Improper Limitation of a Pathname to a Restricted Directory
A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is
- 9.8 Critical severity
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database…
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks fo
- 7.2 High severity
Piwigo: Improper Neutralization of Special Elements used in an SQL Command
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensit
- 7.2 High severity
Piwigo: Improper Neutralization of Special Elements used in an SQL Command
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitiz
- 7.5 High severity
Piwigo: Missing Authorization
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery
- 9.8 Critical severity
Piwigo: Improper Neutralization of Special Elements used in an SQL Command
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly
- 7.5 High severity
Piwigo: Use of Insufficiently Random Values
Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. However, RAND() only has 30 bits of randomness, making it feasible to brute-
- 8.8 High severity
Piwigo: Weak Password Recovery Mechanism for Forgotten Password
Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this
- 8.8 High severity
Piwigo: Improper Neutralization of Special Elements used in an SQL Command
Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user
- 8.8 High severity
Piwigo: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.