Piwigo Arbitrary File Read and RCE via ImageMagick SVG Abuse (CVE-2026-85750)

Piwigo Arbitrary File Read and Remote Code Execution Vulnerability (CVE-2026-85750) Vulnerability Overview Piwigo contains a critical vulnerability affecting version 16.3.0 and earlier. Uploaded files are not sufficiently validated; when images are processed by the ImageMagick library, the file is still interpreted by ImageMagick if its actual content does not match its declared extension. Users with administrator privileges can read arbitrary files on the server and, depending on the ImageMagick configuration, may write files, thereby achieving remote code execution. Vulnerability Details: CVE: CVE-2026-85750 CVSS 3.1 Score: 7.2 (High) Type: CWE-20: Improper Input Validation Affected Versions Affected Versions: ≤ 16.3.0 Fixed Version: 16.4.0 Exploitation Principle 1. Format Confusion: ImageMagick does not trust file extensions but processes files based on their content. An attacker can upload a file named whose actual content is SVG. 2. Arbitrary File Read: The element in SVG can reference local files (such as ) via ImageMagick's pseudo-protocol, displaying the file's content in the generated thumbnail. 3. Code Execution: Attackers can leverage MSL (Magick Scripting Language) to write malicious code into server-executable directories (e.g., PHP files), thereby obtaining remote code execution privileges. POC / Exploit Code SVG code example provided in the page for reading : Remediation 1. Upgrade Version: It is recommended to upgrade all instances to Piwigo 16.4.0 or higher. 2. Temporary Mitigation Measures (if immediate upgrade is not possible): Strictly validate the type of uploaded files based on actual MIME types and magic bytes, rather than relying solely on file extensions. Sanitize accepted SVG files by stripping dangerous elements and resource references. Strengthen ImageMagick security policies ( ) by disabling dangerous decoders, particularly SVG, MSL, and TEXT. Recommended Configuration Snippet:

Goal Reached Thanks to every supporter — we hit 100%!

Piwigo Arbitrary File Read and RCE via ImageMagick SVG Abuse (CVE-2026-85750)