Path Traversal Vulnerability in Piwigo Image Derivative Handler

hello@craftedsignal.io — Wed, 02 Sep 2026 05:11:53 +0000

Piwigo versions up to and including 16.3.0 are vulnerable to a path traversal flaw residing within the Image Derivative Handler component, specifically within the i.php file. This vulnerability arises from improper input validation, allowing a remote, unauthenticated attacker to supply specially crafted input to manipulate file paths. By exploiting this flaw, an attacker can bypass intended access controls to read sensitive files or potentially interact with arbitrary files located on the underlying server filesystem. Given that the exploit code has been publicly disclosed, the barrier to entry for exploitation is low, and organizations running affected Piwigo installations should prioritize mitigation.

Impact

Successful exploitation of this vulnerability allows unauthorized file access on the host server. This can lead to the exposure of sensitive configuration files, database credentials, or application source code, potentially resulting in complete system compromise depending on the server configuration and file permissions.

Recommendation

Update all Piwigo installations to version 16.3.1 or later immediately. Ensure that the web server process runs with the least privilege necessary to limit the impact of potential path traversal attacks.

Piwigo (<= 16.3.0) - CraftedSignal Threat Feed

Path Traversal Vulnerability in Piwigo Image Derivative Handler

Impact

Recommendation