CVE-2026-78187
Piwigo Public Authentication cross site scripting
- State
- Published
- Severity
- 2.3 Low
- Published
- Aug 24, 2026
- Updated
- Aug 24, 2026
- Reserved
- Aug 23, 2026
Description
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 16.4.0 will fix this issue. The name of the patch is 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e. It is recommended to upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 3.0 | 3.1 Low | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 2.0 | 2.6 Low | AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Piwigon/a |
|
References
- VDB-394569 | Piwigo Public Authentication cross site scriptingvdb-entrytechnical-description
- VDB-394569 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-78187 | CVE Analysis and Reportthird-party-advisory
- Submit #885228 | Piwigo 16.3.0 Cross Site Scriptingthird-party-advisory
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-rr39-mf4j-6594related
- https://github.com/Leousum/VulnPoC/blob/main/Piwigo%2016.3.0/reflected_XSS.mdexploit
- https://github.com/Piwigo/Piwigo/commit/5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9epatch
- https://github.com/Piwigo/Piwigo/releases/tag/16.4.0patch
- https://github.com/Piwigo/Piwigo/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.