Description

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-02T03:16:47.980Z",
  "pubdate": "2026-09-02T03:16:47.980Z",
  "executiveSummary": "A critical path traversal vulnerability has been identified in Piwigo versions up to 16.3.0, specifically residing within the i.php file of the Image Derivative Handler component.\nThis vulnerability allows an unauthenticated remote attacker to manipulate file path parameters, leading to unauthorized file system access.\nThe flaw poses a significant security risk, as it facilitates the potential reading of sensitive files located outside the intended application directory.\nThe existence of public exploit code increases the urgency for remediation, as it lowers the barrier for exploitation by malicious actors.\nThe vulnerability is remotely exploitable without requiring prior authentication, necessitating immediate patching or the application of compensating security controls to prevent unauthorized data exposure and potential system compromise.",
  "technicalDetails": "The vulnerability manifests within the i.php script, which serves as the core handler for image derivatives within the Piwigo ecosystem. The primary root cause is insufficient sanitization and validation of user-supplied input parameters that are passed to file system operations.\nThe Image Derivative Handler is designed to process and serve image files dynamically. However, it fails to properly neutralize directory traversal sequences—specifically '../' (dot-dot-slash) sequences—within the input arguments used to construct file paths.\nThe attack flow begins when an attacker sends a crafted HTTP request to the i.php file, injecting malicious traversal sequences into the input parameter expected to identify the image derivative. Because the application logic does not adequately restrict the resolution of these paths, the underlying file system API traverses outside the intended image directory.\nBy manipulating these parameters, an attacker can coerce the application into accessing files stored on the host server that the web server process has read permissions for. This can include configuration files, credentials, or sensitive system data, depending on the server's directory structure and permission configuration.\nExploitation does not require authentication, meaning the attack vector is accessible to any remote user with network access to the web server. The lack of validation at the application entry point ensures that the processed path is resolved by the server, effectively bypassing standard web application sandbox protections.\nThe post-exploitation impact includes unauthorized disclosure of sensitive information (Information Disclosure), potentially leading to further reconnaissance, credential theft, or the discovery of internal environment details that facilitate more advanced attacks against the underlying infrastructure.\nBecause the exploit is disclosed publicly, automated scanners and threat actors are likely testing for this vulnerability in the wild. Ensuring that all user input destined for file system interaction is validated against an allow-list or normalized and checked for traversal sequences is critical to securing the i.php handler."
}