adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Stored Cross-Site Scripting Vulnerability #1691

New Issue
Closed
opened 2026-10-05 00:53:08 +02:00 by adam · 1 comment
adam commented 2026-10-05 00:53:08 +02:00
Owner
Copy link
Copy source

Hi,
After logging into the system with the admin user, I upload a photo to the system.

2

3

4

Open the uploaded photo for editing. Write the XSS payload in the description and then save the photo.

5

Now, anyone registered or not in the system will be affected by the XSS vulnerability when they open this image.

6

7

The latest version 13.7.0 is affected by this vulnerability.

Hi, After logging into the system with the admin user, I upload a photo to the system. ![2](https://github.com/Piwigo/Piwigo/assets/33905344/3683f114-afbd-488f-a25f-6fe53846abaf) ![3](https://github.com/Piwigo/Piwigo/assets/33905344/438b22a3-4c9d-4a6a-bfd4-4d4aaad02356) ![4](https://github.com/Piwigo/Piwigo/assets/33905344/820f8944-2451-4a06-9ff9-eb28c3d54195) Open the uploaded photo for editing. Write the XSS payload in the description and then save the photo. ![5](https://github.com/Piwigo/Piwigo/assets/33905344/432c00a2-6e40-414a-b41f-16a0e5af8b64) Now, anyone registered or not in the system will be affected by the XSS vulnerability when they open this image. ![6](https://github.com/Piwigo/Piwigo/assets/33905344/d2d6479d-0e0b-4ed3-8a6a-e91a736cbb96) ![7](https://github.com/Piwigo/Piwigo/assets/33905344/8bf313a3-ca26-408e-8596-536a53d95bc8) The latest version 13.7.0 is affected by this vulnerability. <!-- github-sync-id:1786125168 -->
adam closed this issue 2026-10-05 00:53:08 +02:00
adam commented 2026-10-05 00:53:09 +02:00
Author
Owner
Copy link
Copy source

This is not a bug or considered as a security issue. An administrator can insert HTML/JS/CSS into a photo description. A webmaster can change that with this local configuration setting:

// allow_html_descriptions : authorize administrators to use HTML in
// category and element description.
$conf['allow_html_descriptions'] = true;
This is not a bug or considered as a security issue. An administrator can insert HTML/JS/CSS into a photo description. A webmaster can change that with this local configuration setting: ``` // allow_html_descriptions : authorize administrators to use HTML in // category and element description. $conf['allow_html_descriptions'] = true; ``` <!-- github-comment-id:1625099975 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1691