CVE-2026-42322: Piwigo: Authenticated RCE via File Upload in Logo Upload Feature
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Piwigoto a version that resolves this vulnerability.Fixed in 16.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Piwigo administrator can exploit it. The issue is exposed through the logo upload feature in the standard pages administration area.
What conditions are required for uploaded content to execute?
The attacker must upload image content while supplying a server-executable filename extension through the logo setting. Execution occurs only if the web server is configured to execute that extension in the web-accessible logo directory.
Are default deployments necessarily vulnerable to code execution?
The vulnerable upload behavior exists in versions before 16.4.0, but code execution depends on whether the web server handles the attacker-selected extension as executable in that directory. The provided information does not establish which web-server configurations do so by default.
What can be done if upgrading is not immediately possible?
Restrict administrator access and prevent execution of server-side script extensions in the web-accessible logo directory. This reduces the ability to turn an uploaded file into executable code.
How can administrators determine whether they need to remediate?
Check the deployed Piwigo version: versions earlier than 16.4.0 are affected by the described filename-extension handling. Also review whether the logo upload directory is web accessible and whether the web server executes uploaded extensions there.