CVE-2026-42322

Description

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: CRITICAL
CVSS score: 9.1 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Effective score: 9.1 / 10 CRITICAL source: CNA overview
CWE(s): CWE-434
Reserved: 2026-04-26
Published: 2026-09-25 15:50 UTC
Last updated: 2026-09-25 15:50 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42322.json
Linked Threat: CVE-2026-42322 — Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-25 16:17:25 UTC
NVD last modified: 2026-09-25 16:17:25 UTC
NVD CVSS v3.1: 9.1 / 10 CRITICAL source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploitability subscore: 2.3 / 10
Impact subscore: 6.0 / 10

Affected products (1)

Vendor	Product	Versions	Platforms
Piwigo	Piwigo	`< 16.4.0` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv x_refsource_CONFIRM
https://github.com/Piwigo/Piwigo/commit/1e7f7262cb30e6916779f93e66d5d6579ec75a11 x_refsource_MISC
https://github.com/Piwigo/Piwigo/commit/4a13ec9a8f4881ae1f23bdfd24d7b90cd0802cdc x_refsource_MISC
https://github.com/Piwigo/Piwigo/releases/tag/16.4.0 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/Piwigo/Piwigo/commit/1e7f7262cb30e6916779f93e66d5d6579ec75a11 security-advisories@github.com
https://github.com/Piwigo/Piwigo/commit/4a13ec9a8f4881ae1f23bdfd24d7b90cd0802cdc security-advisories@github.com
https://github.com/Piwigo/Piwigo/releases/tag/16.4.0 security-advisories@github.com
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv security-advisories@github.com

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-42322.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "< 16.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T15:50:34.662Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/1e7f7262cb30e6916779f93e66d5d6579ec75a11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/1e7f7262cb30e6916779f93e66d5d6579ec75a11"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/4a13ec9a8f4881ae1f23bdfd24d7b90cd0802cdc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/4a13ec9a8f4881ae1f23bdfd24d7b90cd0802cdc"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/releases/tag/16.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/releases/tag/16.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-7w97-5g4p-xqvv",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo: Authenticated RCE via File Upload in Logo Upload Feature"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42322",
    "datePublished": "2026-09-25T15:50:34.662Z",
    "dateReserved": "2026-04-26T12:37:18.170Z",
    "dateUpdated": "2026-09-25T15:50:34.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}