# CVE-2026-85750: Piwigo arbitrary file read and RCE in image upload handling

Source: https://junglewise.ai/threats/cve-2026-85750-piwigo-before-v16-4-0-is-vulnerable-to-arbitrary-file-read-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85750 · Severity: high · CVSS 7.2 · Published 2026-09-25

Piwigo is an open-source web application for managing and sharing photo galleries. When using the Imagick library, it fails to properly validate uploaded image files, allowing an authenticated administrator to disguise malicious SVG content as PNG images. This can lead to unauthorized reading of sensitive server files like configuration and database credentials, and in some cases remote code execution depending on ImageMagick configuration.

Technologies: [Piwigo](https://junglewise.ai/threats/technologies/piwigo). Vendors: [Piwigo](https://junglewise.ai/threats/vendors/piwigo).

## Quick answers

**Is CVE-2026-85750 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85750 being exploited in the wild.

**How severe is CVE-2026-85750?** High severity, with a CVSS score of 7.2, published 25 September 2026.

**Which products and versions are affected?** Piwigo through 16.3.0.

**Is there a fix for CVE-2026-85750?** A patch was published on 2026-05-03. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85750 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85750?** Check whether you run Piwigo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from improper input validation (CWE-20) in image upload handling when Imagick is enabled. An attacker with admin privileges can upload SVG files with PNG extensions, causing ImageMagick to interpret them as SVG format; by leveraging SVG's reference capabilities and Magick Scripting Language (MSL) support, attackers can read arbitrary files via pseudo-protocols (e.g., text:/etc/passwd) or write files and achieve RCE. The vulnerability affects Piwigo versions through 16.3.0 and was fixed in 16.4.0.

## Affected products

- Piwigo Piwigo through 16.3.0

## Timeline

- 2026-07-18: disclosed
- 2026-05-03: patched

## References

- [https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw](https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw)
- [https://www.helx.io/en/blog/advisory-piwigo](https://www.helx.io/en/blog/advisory-piwigo)

## Related threats

- [Piwigo SQL injection in image rating search](https://junglewise.ai/threats/cve-2026-62262-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in upgrade authentication](https://junglewise.ai/threats/cve-2026-44642-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection via unvalidated image_order parameter](https://junglewise.ai/threats/cve-2026-42324-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in batch manager filter](https://junglewise.ai/threats/cve-2026-42323-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo arbitrary code execution via logo upload extension validation bypass](https://junglewise.ai/threats/cve-2026-42322-piwigo-is-a-full-featured-open-source-photo-gallery-application)