CVE-2026-78187: Cross Site Scripting in Piwigo
CVE-2026-78187 is a cross-site scripting (XSS) vulnerability found in Piwigo version 16.3.0 affecting the Public Authentication Page component. The issue arises from improper handling of the 'lang' argument, allowing remote attackers to inject malicious scripts. Exploitation complexity is high and requires user interaction, with no privileges needed. The vulnerability has been publicly disclosed, but no known exploits are reported in the wild. Upgrading to Piwigo version 16.4.0 resolves this issue.
AI Analysis
Technical Summary
This vulnerability in Piwigo 16.3.0 involves a cross-site scripting flaw in the Public Authentication Page component due to improper sanitization of the 'lang' parameter. An attacker can manipulate this argument remotely to execute arbitrary scripts in the context of the victim's browser. The attack complexity is high, and user interaction is required. The vulnerability has been publicly disclosed, and a patch is available in version 16.4.0 identified by commit 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users visiting the affected authentication page, potentially leading to session hijacking or other client-side impacts. However, the low CVSS score (2.3) and high attack complexity indicate limited impact and difficulty in exploitation. No known active exploitation in the wild has been reported.
Mitigation Recommendations
Upgrade Piwigo to version 16.4.0, which contains the official fix for this vulnerability. Since the patch is available, applying this update is the recommended remediation. No additional mitigations are specifically required beyond upgrading.
CVE-2026-78187: Cross Site Scripting in Piwigo
Description
CVE-2026-78187 is a cross-site scripting (XSS) vulnerability found in Piwigo version 16.3.0 affecting the Public Authentication Page component. The issue arises from improper handling of the 'lang' argument, allowing remote attackers to inject malicious scripts. Exploitation complexity is high and requires user interaction, with no privileges needed. The vulnerability has been publicly disclosed, but no known exploits are reported in the wild. Upgrading to Piwigo version 16.4.0 resolves this issue.
CVSS v4.0
Score 2.3low
Affected software
cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Piwigo 16.3.0 involves a cross-site scripting flaw in the Public Authentication Page component due to improper sanitization of the 'lang' parameter. An attacker can manipulate this argument remotely to execute arbitrary scripts in the context of the victim's browser. The attack complexity is high, and user interaction is required. The vulnerability has been publicly disclosed, and a patch is available in version 16.4.0 identified by commit 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users visiting the affected authentication page, potentially leading to session hijacking or other client-side impacts. However, the low CVSS score (2.3) and high attack complexity indicate limited impact and difficulty in exploitation. No known active exploitation in the wild has been reported.
Mitigation Recommendations
Upgrade Piwigo to version 16.4.0, which contains the official fix for this vulnerability. Since the patch is available, applying this update is the recommended remediation. No additional mitigations are specifically required beyond upgrading.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-23T16:57:37.940Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8bce18acd9273b49f5b7cd
Added to database: 08/24/2026, 04:52:40 UTC
Last enriched: 08/24/2026, 05:07:13 UTC
Last updated: 08/24/2026, 05:14:24 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.