Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-5608: Piwigo image upload allows attackers to run code

CVE-2017-5608 · published 9 years ago

Summary

The picture upload feature in Piwigo can be tricked by giving the image a specially crafted name, causing malicious script or HTML to run when the image is displayed. This could let an attacker steal information or take control of a user’s session. Upgrade to Piwigo version 2.8.6 or later, or apply the available security patch, and limit image uploads to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
piwigo	piwigo	<= 2.8.5 `cpe:2.3:a:piwigo:piwigo::::::::`

Original advisory text

Cross-site scripting (XSS) vulnerability in the image upload function in Piwigo before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via a crafted image filename.

References

http://piwigo.org/releases/2.8.6 Release Notes Vendor Advisory
http://www.securityfocus.com/bid/95848 Third Party Advisory VDB Entry
https://github.com/Piwigo/Piwigo/commit/6ec3f2d0fae0437f0c2cc8c475a26fb6aeb0d4cb Issue Tracking Patch Third Party Advisory
https://github.com/Piwigo/Piwigo/issues/600 Issue Tracking Patch Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published28 Jan 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-5608 · NVD

Track software like this

Free during beta