adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Potential Security Issue #1240

New Issue
Closed
opened 2026-10-05 00:37:17 +02:00 by adam · 4 comments
adam commented 2026-10-05 00:37:17 +02:00
Owner
Copy link
Copy source

Hello,

We recently received a vulnerability disclosure against your repository. I couldn't find an e-mail to contact or a security process to follow, so created this issue instead.

If you would like me to e-mail over the details or put them on the GitHub Issue, I'm more than happy to facilitate this for you. Otherwise, you can access the advisory here.

It is private to you and the discloser of the report.

If you have any questions, let me know.

-- Jamie from huntr.dev

Hello, We recently received a vulnerability disclosure against your repository. I couldn't find an e-mail to contact or a security process to follow, so created this issue instead. If you would like me to e-mail over the details or put them on the GitHub Issue, I'm more than happy to facilitate this for you. Otherwise, you can access the advisory [here](https://huntr.dev/bounties/1-other-Piwigo/Piwigo/). It is private to you and the discloser of the report. If you have any questions, let me know. -- Jamie from huntr.dev <!-- github-sync-id:908553961 -->
adam closed this issue 2026-10-05 00:37:17 +02:00
adam commented 2026-10-05 00:37:18 +02:00
Author
Owner
Copy link
Copy source

https://piwigo.org/contact
quite simple

and it seems that's about adding HTML tag (and so script) in the album name, which is a feature

https://piwigo.org/contact quite simple and it seems that's about adding HTML tag (and so script) in the album name, which is a feature <!-- github-comment-id:852346413 -->
adam commented 2026-10-05 00:37:18 +02:00
Author
Owner
Copy link
Copy source

These things shouldn't be a feature, since they put the user at risk..

These things shouldn't be a feature, since they put the user at risk.. <!-- github-comment-id:852368361 -->
adam commented 2026-10-05 00:37:19 +02:00
Author
Owner
Copy link
Copy source

Not at all
If an non admin user can alter a website without getting permission, that's an issue. That's a kind of an elevation of privileges
If an admin can alter a website, well that's just the admin doing what it should do.
Be it Album title or the description of a picture, or the header, or anything.

Let's wait for the report to judge what is happening here

Not at all If an non admin user can alter a website without getting permission, that's an issue. That's a kind of an elevation of privileges If an admin can alter a website, well that's just the admin doing what it should do. Be it Album title or the description of a picture, or the header, or anything. Let's wait for the report to judge what is happening here <!-- github-comment-id:852410775 -->
adam commented 2026-10-05 00:37:20 +02:00
Author
Owner
Copy link
Copy source

The report is already here in the first post..
However why is this a feature? Why would an admin want to insert HTML tags, and especially a script tag? There is really no useful use for it other than malicious stuff..
Take a look at a system like Wordpress, they also don't have this "feature"..

The report is already here in the first post.. However why is this a feature? Why would an admin want to insert HTML tags, and especially a script tag? There is really no useful use for it other than malicious stuff.. Take a look at a system like Wordpress, they also don't have this "feature".. <!-- github-comment-id:852772107 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1240