Arbitrary Command Execution in Piwigo Photo Gallery Application

CVE-2026-42322

What is CVE-2026-42322?

Piwigo, an open source photo gallery application, features a vulnerability in its earlier versions where an authenticated administrator can upload malicious files via the logo upload function. By leveraging this vulnerability, an attacker can exploit the system by uploading an image file with a server-executable extension, allowing for potential arbitrary command execution and access to sensitive data. This issue is resolved in version 16.4.0, emphasizing the importance of keeping software updated to mitigate security risks.

References