CVE-2026-85750: Piwigo arbitrary file read and remote code execution via insecure image processing
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Piwigoto a version that resolves this vulnerability.Fixed in 16.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges, as reflected by the PR:H vector, and network access to the affected Piwigo instance. Exploitation is tied to the image upload handling path and requires the server to use the Imagick library.
Are all vulnerable Piwigo image-processing configurations equally exposed?
No. Arbitrary file read can result from unsafe processing of crafted image content, while the more advanced file-write and remote-code-execution scenario depends on configuration that permits abuse of Imagick's Magick Scripting Language support.
What should be done if patching cannot happen immediately?
Reduce exposure to image uploads by high-privilege users and review whether the instance uses Imagick. Where feasible, disable or restrict processing paths that allow attacker-controlled image content to reach Imagick, particularly MSL-capable processing.
How can administrators determine whether they are affected?
Piwigo versions before 16.4.0 are affected when they use Imagick for image upload processing. Review the deployed Piwigo version and its configured image-processing library.