CVE-2026-84441: Path Traversal in Piwigo

This vulnerability in Piwigo up to version 16.3.0 is caused by improper handling of file paths in the i.php file of the Image Derivative Handler component, leading to a path traversal condition. This allows remote attackers to manipulate the file path parameter to access files outside the intended directory. The vulnerability is remotely exploitable without authentication. Public exploit code is available, but no official patch or remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation could allow an attacker to read arbitrary files on the server running Piwigo, potentially exposing sensitive information. The vulnerability does not require user interaction or privileges, increasing its risk. However, the CVSS vector indicates low complexity and no user interaction, but limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable component and monitor for exploitation attempts. Consider applying web application firewall rules to block path traversal patterns targeting i.php. Avoid exposing the vulnerable endpoint to untrusted networks.