Description

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 16.4.0 will fix this issue. The name of the patch is 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-24T05:16:55.507Z",
  "pubdate": "2026-08-24T05:16:55.507Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability has been identified in Piwigo version 16.3.0, specifically within the Public Authentication Page component. The flaw arises from improper handling of user-supplied input passed via the lang parameter, allowing remote attackers to inject malicious client-side scripts into the application's response.\nSuccessful exploitation of this vulnerability can lead to the execution of arbitrary JavaScript in the context of a victim's browser session, potentially enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the user.\nThe attack can be executed remotely without prior authentication, though the associated attack complexity is rated as high and exploitability is described as difficult. Mitigation requires upgrading the affected installation to version 16.4.0 or applying the official vendor patch identified by the commit hash 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e.",
  "technicalDetails": "The vulnerability resides in the Public Authentication Page component of Piwigo 16.3.0, specifically stemming from insufficient input sanitization and output encoding of the lang argument. When unvalidated user input from the HTTP request parameter is dynamically reflected back into the Hypertext Markup Language (HTML) document or processed insecurely within the Document Object Model (DOM), it facilitates cross-site scripting.\nThe attack vector is network-based, allowing remote adversaries to deliver malicious payloads without requiring local access or pre-existing authentication privileges. However, the specific conditions required for successful execution introduce a high level of complexity and render the exploit difficult to operationalize reliably.\nDuring a typical attack flow, an attacker crafts a malicious URL containing JavaScript payloads within the vulnerable lang parameter and induces a target user to access the crafted link on the Public Authentication Page. Upon processing the request, the application fails to properly neutralize the script tags or special characters, causing the browser to execute the injected payload within the security context of the victim's session.\nThe resulting impact is constrained by the privileges of the victim interacting with the application, but generally includes the execution of arbitrary script code, unauthorized access to sensitive session tokens, and potential manipulation of the user interface to facilitate further social engineering or exploitation."
}