Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

piwigo — Vulnerabilities & Security Advisories 21

All 21 CVE vulnerabilities found in piwigo, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting the Piwigo open-source photo gallery software, specifically focusing on weaknesses within its web application architecture. The collection encompasses a comprehensive history of reported flaws spanning over a decade, including critical issues related to remote code execution, SQL injection, cross-site scripting, and file inclusion vulnerabilities that have impacted various versions of the platform. Visitors can utilize this resource to track official security advisories released by the Piwigo development team, analyze the prevalence of specific weakness classes within the product over time, and review the complete vulnerability timeline to assess the security posture of their own installations. The data presented here is derived from public security databases and vendor disclosures, offering a centralized view of historical risks without providing specific exploit code or detailed technical proofs of concept. By examining the patterns of reported issues, administrators and developers can better understand the evolution of security challenges in the Piwigo ecosystem and make informed decisions regarding patch management and system hardening. This archive serves as a factual reference for security professionals conducting risk assessments or auditing the integrity of deployed photo management systems based on the Piwigo framework.

Vendor: piwigo

CVE ID Title CVSS Severity Published
CVE-2026-42322 Piwigo: Authenticated RCE via File Upload in Logo Upload Feature CWE-434 9.1 Critical 2026-09-25
CVE-2026-42324 Piwigo: Second-Order SQL Injection CWE-89 7.2 High 2026-09-25
CVE-2026-44642 Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+) CWE-89 8.1 High 2026-09-25
CVE-2026-62262 Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create` CWE-89 9.1 Critical 2026-09-25
CVE-2026-42323 Piwigo: SQL Injection in Batch Manager CWE-89 7.2 High 2026-09-25
CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing CWE-20 7.2 High 2026-09-25
CVE-2026-84441 Piwigo Image Derivative i.php path traversal CWE-22 7.3 High 2026-09-02
CVE-2026-78187 Piwigo Public Authentication cross site scripting CWE-79 3.1 Low 2026-08-24
CVE-2026-35048 Piwigo RCE via PHP Code Injection into Config File in Installer CWE-20 9.8 Critical 2026-07-20
CVE-2026-27885 Piwigo: SQL Injection in Activity.getList CWE-89 7.2 High 2026-04-03
CVE-2026-27834 Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter CWE-89 7.2 High 2026-04-03
CVE-2026-27833 Piwigo: Unauthenticated Information Disclosure via pwg.history.search API CWE-862 7.5 High 2026-04-03
CVE-2026-27634 Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter CWE-89 7.5AI High AI 2026-04-03
CVE-2025-62512 Piwigo Vulnerable to User Enumeration via Password Reset Endpoint CWE-204 5.3 - 2026-02-24
CVE-2024-48928 Piwigo's secret key can be brute forced CWE-330 7.5 - 2026-02-24
CVE-2025-62406 Piwigo is vulnerable to one-click account takeover by modifying the password-reset link CWE-640 8.1 High 2025-11-18
CVE-2023-44393 Piwigo Reflected XSS vulnerability CWE-79 9.3 Critical 2023-10-09
CVE-2023-37270 Piwigo SQL Injection vulnerability in "User-Agent" CWE-89 7.6 High 2023-07-07
CVE-2016-3735 Piwigo 安全漏洞 CWE-335 8.1 - 2022-01-28
CVE-2012-4526 Piwigo 跨站脚本漏洞 6.1 - 2019-12-02
CVE-2012-4525 Piwigo 跨站脚本漏洞 6.1 - 2019-12-02

All 21 known CVE vulnerabilities affecting piwigo with full Chinese analysis, references, and POCs where available.