CVE-2026-84441— Piwigo Image Derivative i.php path traversal
Quick assessment
Affected
n/a Piwigo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84441
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Piwigo Image Derivative i.php path traversal
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Piwigo | 16.0 |
cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-84441
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84441
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-84441 (1)
Other References for CVE-2026-84441 (4)
-
https://vuldb.com/cve/CVE-2026-84441 third-party-advisory
-
https://vuldb.com/submit/885229 third-party-advisory
-
Same Patch Batch · n/a · 2026-09-02 · 4 CVEs total
| CVE-2026-84430 | 6.3 MEDIUM | gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes |
| CVE-2026-84438 | 3.5 LOW | OpenCart Autocomplete Workflow edit.php cross site scripting |
| CVE-2026-84437 | 3.5 LOW | OpenCart Autocomplete Workflow address.php cross site scripting |
IV. Related Vulnerabilities
Same product: Piwigo
-
CVE-2026-78187
Piwigo Public Authentication cross site scripting -
CVE-2026-35048
Piwigo RCE via PHP Code Injection into Config File in Instal -
CVE-2026-27885
Piwigo: SQL Injection in Activity.getList -
CVE-2026-27834
Piwigo: SQL Injection in pwg.users.getList API Method via fi -
CVE-2026-27833
Piwigo: Unauthenticated Information Disclosure via pwg.histo
Same vendor: n/a
-
CVE-2026-84438
OpenCart Autocomplete Workflow edit.php cross site scripting -
CVE-2026-84437
OpenCart Autocomplete Workflow address.php cross site script -
CVE-2026-84430
gouguoa edit_personal Endpoint Index.php update dynamically- -
CVE-2026-84423
Casdoor upload-resource API resource.go missing authenticati -
CVE-2026-51742
TOTOLINK T6 4.1.5 访问控制不当漏洞
Same weakness: CWE-22
-
CVE-2026-84442
MapQuest Get Directions App com.mapquest.android.ace ExpoSha -
CVE-2026-14982
WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbi -
CVE-2026-84431
AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.R -
CVE-2026-84702
facefusion before 3.7.0 Path Traversal via Job Identifier -
CVE-2026-84374
Laravel Excel writes exports outside the configured filesyst
V. Comments for CVE-2026-84441
No comments yet