User Enumeration Vulnerability in Piwigo Photo Gallery Application
CVE-2025-62512

5.5MEDIUM

Key Information:

Vendor

Piwigo

Status
Piwigo
Vendor
CVE Published:
24 February 2026

What is CVE-2025-62512?

Piwigo, an open-source web-based photo gallery application, is affected by a vulnerability in its password reset functionality. Versions 15.5.0 and potentially earlier 15.x releases allow unauthenticated attackers to determine the existence of usernames or email addresses within the system. This occurs due to distinct response messages returned by the password recovery endpoint, which can be exploited for user enumeration. As of the last update, there are no patches available to mitigate this vulnerability.

Affected Version(s)

Piwigo = 15.5.0

References

https://github.com/Piwigo/Piwigo/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.