CVE-2025-62406: Piwigo is vulnerable to one-click account takeover by modifying the password-reset link
Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62406?
CVE-2025-62406 has been classified as a high severity vulnerability due to potential unauthorized access through the password reset feature.
How do I fix CVE-2025-62406?
To fix CVE-2025-62406, upgrade Piwigo to version 15.7.0 or later, which addresses the vulnerability in the password reset function.
What versions of Piwigo are affected by CVE-2025-62406?
CVE-2025-62406 affects Piwigo versions prior to 15.7.0, including version 15.6.0.
What actions should be taken if I cannot update Piwigo to fix CVE-2025-62406?
If updating Piwigo is not possible, consider disabling the password reset function until a secure version can be deployed.
Is CVE-2025-62406 a known issue in the Piwigo community?
Yes, CVE-2025-62406 has been acknowledged in the Piwigo community and documented in security advisories.