Description

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T14:17:20.330Z",
  "pubdate": "2026-09-25T14:17:20.330Z",
  "executiveSummary": "Piwigo versions prior to 16.4.0 contain a critical vulnerability in the handling of image uploads when utilizing the Imagick library. The flaw stems from insufficient validation of user-supplied files, allowing for format confusion attacks. By disguising malicious content as legitimate image formats, an attacker can coerce the server into processing embedded vector elements or Magick Scripting Language (MSL) instructions.\nThis vulnerability enables arbitrary file read operations and potential remote code execution (RCE) on the underlying server. Successful exploitation allows unauthorized actors to bypass security boundaries, potentially leading to full system compromise or sensitive data exfiltration. The impact is significant, as it permits attackers to manipulate server-side processes through crafted image payloads. This issue has been fully addressed in Piwigo 16.4.0, which mandates stricter validation and processing protocols for uploaded media files. Organizations are advised to update their installations immediately to mitigate the risk of exploitation.",
  "technicalDetails": "The vulnerability resides within the interaction between Piwigo's image processing logic and the Imagick library. The root cause is a failure to enforce rigorous file type validation, specifically regarding the content-to-extension mapping. When Imagick is configured as the image processing engine, it attempts to interpret various file formats based on file signatures and embedded metadata rather than just the file extension.\nAttackers exploit this by performing format confusion. For instance, a malicious SVG file—containing XML entities or script references—may be uploaded with a PNG extension. The Imagick library, depending on its configuration and internal policies, may process this file as an SVG instead of the expected raster format. This allows the attacker to execute unauthorized operations, such as local file inclusion (LFI) via SVG external entity references or XXE-style attacks, which facilitate arbitrary file reading.\nIn more advanced attack scenarios, the threat actor can leverage the Magick Scripting Language (MSL) support within Imagick. MSL is an XML-based scripting language that allows for complex image processing sequences. If the server-side environment allows Imagick to interpret MSL instructions from an attacker-controlled file, the attacker can instruct the library to perform file system operations, such as creating or overwriting files on the server. By carefully crafting an MSL payload, an attacker can achieve remote code execution by writing a web shell to a web-accessible directory or modifying system configurations.\nThe attack flow generally follows these steps: 1) The attacker crafts an image file containing malicious MSL instructions or SVG entities. 2) The attacker uploads this file through Piwigo's image upload interface. 3) Piwigo attempts to process the file using Imagick for thumbnail generation or resizing. 4) Imagick misinterprets the file due to the lack of strict header validation. 5) The embedded malicious instructions are executed with the permissions of the web server process. Post-exploitation impact ranges from information disclosure of configuration files and user data to total server takeover."
}