CVE-2026-84441: Path Traversal in Piwigo

This vulnerability in Piwigo up to version 16.3.0 involves a path traversal issue in the i.php file of the Image Derivative Handler component. An attacker can remotely exploit this flaw by manipulating input to traverse directories and access files outside the intended scope. The vulnerability is identified as CWE-22 (Path Traversal). Public exploit details have been disclosed, but no known exploits are reported in the wild. The CVSS v3.1 score is 6.9, indicating a moderate impact with network attack vector and no privileges or user interaction required.

Successful exploitation could allow remote attackers to read arbitrary files on the server by traversing the file system via the vulnerable component. This could lead to unauthorized disclosure of sensitive information. The vulnerability does not require authentication or user interaction, increasing its risk. However, no active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.