# CVE-2017-5608: Piwigo XSS in image upload filename

Source: https://junglewise.ai/threats/cve-2017-5608-piwigo-xss-in-image-upload-filename  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-28. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5608 · Severity: medium · CVSS 6.1 · Published 2017-01-28

Piwigo, an open-source photo gallery software, is vulnerable to a security flaw in its image upload system. An attacker can upload a file with a specially crafted name containing malicious code. If an administrator or another user views the uploaded image, that code could execute in their browser, potentially leading to unauthorized actions or data theft.

Technologies: [Piwigo](https://junglewise.ai/threats/technologies/piwigo). Vendors: [Piwigo](https://junglewise.ai/threats/vendors/piwigo).

## Quick answers

**Is CVE-2017-5608 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5608 being exploited in the wild.

**How severe is CVE-2017-5608?** Medium severity, with a CVSS score of 6.1, published 28 January 2017.

**Which products and versions are affected?** Piwigo Piwigo < 2.8.6.

**Is there a fix for CVE-2017-5608?** A patch was published on 2017-01-27: Version 2.8.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5608 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2017-5608?** Check whether you run Piwigo. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Piwigo's image upload functionality (specifically via the pwg.images.upload method in ws.php). The application fails to properly sanitize the filename of uploaded images before displaying them in the web interface. An attacker can exploit this by uploading an image with a filename containing HTML or JavaScript payloads. When a user or administrator views the image or its associated metadata, the payload executes in the context of their session. This can lead to session hijacking or unauthorized administrative actions. The issue is fixed in version 2.8.6 by implementing better input handling for uploaded filenames.

## Affected products

- Piwigo Piwigo < 2.8.6

## Timeline

- 2017-01-04: disclosed: Issue reported on GitHub
- 2017-01-27: patched: Version 2.8.6 released
- 2017-01-28: advisory: NVD publication date

## References

- [http://piwigo.org/releases/2.8.6](http://piwigo.org/releases/2.8.6)
- [http://www.securityfocus.com/bid/95848](http://www.securityfocus.com/bid/95848)
- [https://github.com/Piwigo/Piwigo/commit/6ec3f2d0fae0437f0c2cc8c475a26fb6aeb0d4cb](https://github.com/Piwigo/Piwigo/commit/6ec3f2d0fae0437f0c2cc8c475a26fb6aeb0d4cb)
- [https://github.com/Piwigo/Piwigo/issues/600](https://github.com/Piwigo/Piwigo/issues/600)

## Related threats

- [Piwigo SQL injection in image rating search](https://junglewise.ai/threats/cve-2026-62262-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in upgrade authentication](https://junglewise.ai/threats/cve-2026-44642-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection via unvalidated image_order parameter](https://junglewise.ai/threats/cve-2026-42324-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in batch manager filter](https://junglewise.ai/threats/cve-2026-42323-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo arbitrary code execution via logo upload extension validation bypass](https://junglewise.ai/threats/cve-2026-42322-piwigo-is-a-full-featured-open-source-photo-gallery-application)