adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-31 06:02:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Piwigo-15.0.0beta2-Stored XSS Vulnerability #1920

New Issue
Open
opened 2026-10-05 01:01:17 +02:00 by adam · 3 comments
adam commented 2026-10-05 01:01:17 +02:00
Owner
Copy link
Copy source

Hello, I found Stored XSS in Piwigo version 15.0.0beta2

Impact:
Leads to other users inadvertently loading malicious JavaScript while browsing through the photo gallery posted by an attacker, thereby gaining access to the user's cookies and other information.

Here are the complete attack steps:

  1. First, create a new photo album. http://127.0.0.1:8080/admin.php?page=photos_add
    Pasted image 20240822144031
    Pasted image 20240822144107
  2. Create a new photo album, then select "Album" -> "Manage", and choose to edit the newly created album directory. Follow the steps as shown in the figure below.
    Pasted image 20240822144317
  3. Embed a malicious XSS payload into the description, and then select to save it.
    Pasted image 20240822151805
  4. The default photo album is publicly accessible. At this point, you can directly visit the homepage at http://127.0.0.1:8080/index.php and select the directory you just created. Upon doing so, a conspicuous popup should appear on the page.
    Pasted image 20240822151823
    You can also replace the aforementioned payload with a blind XSS platform, which can detect more information.
    Pasted image 20240822152119

Please fix the vulnerability & let me know :).
Thank You!
create by : yingning

Hello, I found Stored XSS in Piwigo version [15.0.0beta2](https://github.com/Piwigo/Piwigo/releases/tag/15.0.0beta2) **Impact:** Leads to other users inadvertently loading malicious JavaScript while browsing through the photo gallery posted by an attacker, thereby gaining access to the user's cookies and other information. **Here are the complete attack steps:** 1. First, create a new photo album. http://127.0.0.1:8080/admin.php?page=photos_add ![Pasted image 20240822144031](https://github.com/user-attachments/assets/1802059d-598c-460a-8910-101439ada77c) ![Pasted image 20240822144107](https://github.com/user-attachments/assets/5657d77b-e7fe-478a-b972-2fc6b1d43007) 2. Create a new photo album, then select "Album" -> "Manage", and choose to edit the newly created album directory. Follow the steps as shown in the figure below. ![Pasted image 20240822144317](https://github.com/user-attachments/assets/94b3fe19-84f0-4272-b38b-af2bb7620e19) 3. Embed a malicious XSS payload into the description, and then select to save it. ![Pasted image 20240822151805](https://github.com/user-attachments/assets/d939a3b5-9be6-4fc2-9c34-8c0bc3b1abcf) 4. The default photo album is publicly accessible. At this point, you can directly visit the homepage at [http://127.0.0.1:8080/index.php](http://127.0.0.1:8080/index.php) and select the directory you just created. Upon doing so, a conspicuous popup should appear on the page. ![Pasted image 20240822151823](https://github.com/user-attachments/assets/9f87e1c2-10d3-4739-96be-9673acfa8dcf) You can also replace the aforementioned payload with a blind XSS platform, which can detect more information. ![Pasted image 20240822152119](https://github.com/user-attachments/assets/59212e3f-2670-410d-92d5-885159db5b14) Please fix the vulnerability & let me know :). Thank You! create by : yingning <!-- github-sync-id:2480088698 -->
adam commented 2026-10-05 01:01:19 +02:00
Author
Owner
Copy link
Copy source

Have you been able to introduce this XSS without an administration access? if yes, then it needs to be fixed urgently. If no, then it's not a bug: an administrator is allowed, by default, to insert HTML into an album description.

Have you been able to introduce this XSS without an administration access? if yes, then it needs to be fixed urgently. If no, then it's not a bug: an administrator is allowed, by default, to insert HTML into an album description. <!-- github-comment-id:2308422197 -->
adam commented 2026-10-05 01:01:19 +02:00
Author
Owner
Copy link
Copy source

Have this been addressed? The vulnerability is still listed in vulnerability databases and I cannot use the software until it is addressed. It is still listed as a vulnerability in the lastest version.

Have this been addressed? The vulnerability is still listed in vulnerability databases and I cannot use the software until it is addressed. It is still listed as a vulnerability in the lastest version. <!-- github-comment-id:2613070731 -->
adam commented 2026-10-05 01:01:20 +02:00
Author
Owner
Copy link
Copy source

Have this been addressed? The vulnerability is still listed in vulnerability databases and I cannot use the software until it is addressed. It is still listed as a vulnerability in the lastest version.

Hello, it's not a vulnerability, it's a normal behaviour in Piwigo, administrators have the right to put html code in descriptions, titles... However, you can block this, even for admins, simply by setting $conf[“allow_html_descriptions”] = false; in LocalFiles Editor (the plugin that allows you to modify the piwigo config).

> Have this been addressed? The vulnerability is still listed in vulnerability databases and I cannot use the software until it is addressed. It is still listed as a vulnerability in the lastest version. Hello, it's not a vulnerability, it's a normal behaviour in Piwigo, administrators have the right to put html code in descriptions, titles... However, you can block this, even for admins, simply by setting `$conf[“allow_html_descriptions”] = false;` in `LocalFiles Editor` (the plugin that allows you to modify the piwigo config). <!-- github-comment-id:2976719455 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1920