adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Stored XSS in description image #881

New Issue
Closed
opened 2026-10-05 00:22:35 +02:00 by adam · 1 comment
adam commented 2026-10-05 00:22:35 +02:00
Owner
Copy link
Copy source

Summary

The parameter description of image is not sanitized after querying from database, so attackers can create a stored XSS attack.

POC

  1. In the description of the image, create a malicious code:
2. Clicking on the image:
# Summary The parameter description of image is not sanitized after querying from database, so attackers can create a stored XSS attack. # POC 1. In the description of the image, create a malicious code: <img src="https://i.imgur.com/VeiR2vL.png"> 2. Clicking on the image: <img src="https://i.imgur.com/fZajgUH.png"> <!-- github-sync-id:438189083 -->
adam closed this issue 2026-10-05 00:22:35 +02:00
adam commented 2026-10-05 00:22:36 +02:00
Author
Owner
Copy link
Copy source

Hi @duypv1997

Yes, a Piwigo administrator can add HTML/JS in the description of a photo. That is not a bug, that is a design choice.

As long as only administrators can "inject" JS, it's fine. The problem would be that an attacker could become administrator, but that's not what you're showing here.

Hi @duypv1997 Yes, a Piwigo administrator can add HTML/JS in the description of a photo. That is not a bug, that is a design choice. As long as only administrators can "inject" JS, it's fine. The problem would be that an attacker could become administrator, but that's not what you're showing here. <!-- github-comment-id:519905021 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#881