CVE-2024-46605 is a cross-site scripting (XSS) vulnerability affecting Piwigo version 14.5.0. The issue exists in the /admin.php?page=album component, where an attacker can inject crafted payloads into the Description field. This injection enables execution of arbitrary web scripts or HTML, which can compromise the integrity of the web interface for users who view the affected content. The vulnerability requires no privileges but does require user interaction (UI:R).

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure or manipulation of the web interface. The impact is limited to confidentiality and integrity with no direct availability impact. The attack vector is network-based with low attack complexity and no privileges required.

No official patch or remediation has been provided yet for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted input in the Description field and consider restricting access to the affected component to trusted users only.