7 matches found
CVE-2026-85750
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...
CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...
EUVD-2026-87094
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...
CVE-2026-85750
Versions of Piwigo prior to v16.4.0 are vulnerable to arbitrary file read and remote code execution (RCE) during image upload handling when utilizing the Imagick library . The root cause is insufficient validation and unsafe processing of user-supplied image files. Specifically, an attacker can e...
CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...
PT-2026-98860
Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description Insufficient validation and unsafe processing of user-supplied image files when using the Imagick library allow for arbitrary file read and remote code execution. Attackers can use format confusion,...
AZL-83184 CVE-2026-3219 affecting package python-pip for versions less than 24.2-8
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...