adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Security: DOM-Based XSS via Tag Name in Tag Creation Notification #2235

New Issue
Closed
opened 2026-10-27 11:34:51 +01:00 by adam · 0 comments
adam commented 2026-10-27 11:34:51 +01:00
Owner
Copy link
Copy source

Reported issue at August 31, 2026 via GHSA, follow-up email at September 12, 2026. No respone from vendor.

Summary

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the tag creation success notification. The application inserts the user-controlled tag name into the success message without HTML encoding, allowing arbitrary HTML/JavaScript to execute in the browser when a tag is created.

Details

Tested environment:

  1. Piwigo: 17.0.0beta1
  2. PHP: 8.2.12
  3. MariaDB: 10.4.32

The vulnerable code (admin\themes\default\js\tags.js) retrieves the tag name directly from the #add-tag-input field and passes it to showMessage():

addTag($('#add-tag-input').val()).then(function () {
    showMessage(str_tag_created.replace('%s', $('#add-tag-input').val()));
    $('#add-tag-input').val("");
    $('#add-tag').removeClass('input-mode');
    $("#search-tag .search-input").trigger("input");
    loadState.reverse();
})

The value returned by:

$('#add-tag-input').val()

is inserted directly into the str_tag_created message without HTML encoding or sanitization.

For example, if str_tag_created is:

Tag "%s" created

an attacker-controlled tag name containing an HTML event handler is inserted into the resulting message.

If showMessage() renders the message using an HTML sink such as innerHTML or jQuery .html(), the injected HTML/JavaScript is interpreted by the browser and executed in the security context of the affected application.

Notably, the payload does not need to remain stored in the database for this vulnerability to occur. The XSS is triggered immediately while processing the client-side success notification after tag creation.

PoC

  1. Log in as admin that has permission to create tags.
  2. Navigate to Photo -> Keyword -> Add tag.
    Create a new tag using the following payload as the tag name:
    <script>alert("XSS")</script>
    and click + to Add.
  3. After the tag is successfully created, the application displays a message similar to:
    Tag "" created
    The injected JavaScript executes immediately in the application's origin and alert("XSS").
    image

Impact

Successful exploitation can allow an attacker who is able to control the tag name to perform actions in the victim's browser with the victim's privileges, access data available to the application, or perform unauthorized actions on behalf of the victim.

Reported issue at August 31, 2026 via GHSA, follow-up email at September 12, 2026. No respone from vendor. ### Summary A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the tag creation success notification. The application inserts the user-controlled tag name into the success message without HTML encoding, allowing arbitrary HTML/JavaScript to execute in the browser when a tag is created. ### Details Tested environment: 1. Piwigo: 17.0.0beta1 2. PHP: 8.2.12 3. MariaDB: 10.4.32 The vulnerable code (`admin\themes\default\js\tags.js`) retrieves the tag name directly from the `#add-tag-input` field and passes it to `showMessage()`: ``` addTag($('#add-tag-input').val()).then(function () { showMessage(str_tag_created.replace('%s', $('#add-tag-input').val())); $('#add-tag-input').val(""); $('#add-tag').removeClass('input-mode'); $("#search-tag .search-input").trigger("input"); loadState.reverse(); }) ``` The value returned by: ``` $('#add-tag-input').val() ``` is inserted directly into the `str_tag_created` message without HTML encoding or sanitization. For example, if str_tag_created is: ```Tag "%s" created``` an attacker-controlled tag name containing an HTML event handler is inserted into the resulting message. If `showMessage()` renders the message using an HTML sink such as `innerHTML` or `jQuery .html()`, the injected HTML/JavaScript is interpreted by the browser and executed in the security context of the affected application. Notably, the payload does not need to remain stored in the database for this vulnerability to occur. The XSS is triggered immediately while processing the client-side success notification after tag creation. ### PoC 1. Log in as admin that has permission to create tags. 2. Navigate to Photo -> Keyword -> Add tag. Create a new tag using the following payload as the tag name: ```<script>alert("XSS")</script>``` and click + to Add. 3. After the tag is successfully created, the application displays a message similar to: ``Tag "" created`` The injected JavaScript executes immediately in the application's origin and alert("XSS"). <img width="1472" height="610" alt="image" src="https://github.com/user-attachments/assets/bc609a07-86ed-4cd8-bee4-8b3f25b3c9ce" /> ### Impact Successful exploitation can allow an attacker who is able to control the tag name to perform actions in the victim's browser with the victim's privileges, access data available to the application, or perform unauthorized actions on behalf of the victim. <!-- github-sync-id:5713569498 -->
adam closed this issue 2026-10-27 11:34:51 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#2235