Piwigo Photo Gallery Application Vulnerability in Password Reset Feature

CVE-2025-62406

What is CVE-2025-62406?

Piwigo, an open source photo gallery application, has a vulnerability in its password reset functionality present in version 15.6.0. The application constructs password-reset URLs using the Host header from HTTP requests without proper validation. This oversight enables attackers to generate malicious password-reset links by modifying the hostname, potentially tricking users into submitting their credentials. This security flaw has been addressed in version 15.7.0, ensuring that hostname validation is implemented to safeguard against such attacks.

References