Quick answers
- Is CVE-2026-42322 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42322 being exploited in the wild.
- How severe is CVE-2026-42322?
- Critical severity, with a CVSS score of 9.1, published 25 September 2026.
- Which products and versions are affected?
- Piwigo before 16.4.0.
- Is there a fix for CVE-2026-42322?
- A patch was published on 2026: Fixed in version 16.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42322 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-42322?
- Check whether you run Piwigo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in admin/themes_standard_pages.php where logo upload validation checks MIME type but fails to sanitize or restrict the file extension, instead reusing the attacker-controlled extension from the std_pgs_logo parameter when storing the file. An authenticated administrator can craft a request with image MIME type but a server-executable extension (e.g., .php), which is then written to a web-accessible logo directory and executed upon access. The issue is resolved in version 16.4.0 with more robust file type checking.
Affected products
- Piwigo Piwigo before 16.4.0
Timeline
- 2026-09-25: disclosed
- 2026: patched: Fixed in version 16.4.0