adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Piwigo 2.9.5 XSS #938

New Issue
Closed
opened 2026-10-05 00:24:37 +02:00 by adam · 4 comments
adam commented 2026-10-05 00:24:37 +02:00
Owner
Copy link
Copy source

There is a critical XSS issue in /admin/permalinks.php that allows for an attacker to easily send an admin a link that drops a PHP shell silently for an attacker.

Proof of Concept

Creating a pull request right now to fix this issue.

P.S. You guys should really get a security contact set up so that people can report these issues privately.

There is a critical XSS issue in /admin/permalinks.php that allows for an attacker to easily send an admin a link that drops a PHP shell silently for an attacker. [Proof of Concept](https://github.com/Piwigo/Piwigo/files/3605455/sploit.txt) Creating a pull request right now to fix this issue. P.S. You guys should really get a security contact set up so that people can report these issues privately. <!-- github-sync-id:492775051 -->
adam closed this issue 2026-10-05 00:24:37 +02:00
adam commented 2026-10-05 00:24:38 +02:00
Author
Owner
Copy link
Copy source

Pull request https://github.com/Piwigo/Piwigo/pull/1076 fixes this issue.

Pull request https://github.com/Piwigo/Piwigo/pull/1076 fixes this issue. <!-- github-comment-id:530805953 -->
adam commented 2026-10-05 00:24:39 +02:00
Author
Owner
Copy link
Copy source

P.S. You guys should really get a security contact set up so that people can report these issues privately.

Hear hear! It's a worry that all these reports are being made publicly.

> P.S. You guys should really get a security contact set up so that people can report these issues privately. Hear hear! It's a worry that all these reports are being made publicly. <!-- github-comment-id:531085574 -->
adam commented 2026-10-05 00:24:39 +02:00
Author
Owner
Copy link
Copy source

(Sorry, to clarify: I'm super grateful for people who are making security reports; just worried about the security of unpatched sites out in the wild.)

(Sorry, to clarify: I'm super grateful for people who are making security reports; just worried about the security of unpatched sites out in the wild.) <!-- github-comment-id:531085703 -->
adam commented 2026-10-05 00:24:40 +02:00
Author
Owner
Copy link
Copy source

1] @samwilson What is your comment contributing to this thread? Rhetorical BTW. No one cares because it has nothing to do with this bug. This is a bug report where people discuss technical things specifically, not Twitter.
2] I simply did my good duty to both report a bug to the vendor, and even provide a patch to help fix the issue. At anytime the Piwigo team could have set the visibility of this bug to private. (Or even had a dedicated security contact, with a PGP key etc.) But, as you can see from the history of closed Piwigo issues on Github that reporting security issues via the Piwigo bug tracker seems to be the norm.

If anyone else has any opinions or questions please keep them out of bug reports and feel free to contact me or Piwigo on Twitter instead. Thanks.

1] @samwilson What is your comment contributing to this thread? Rhetorical BTW. No one cares because it has nothing to do with this bug. This is a bug report where people discuss technical things specifically, not Twitter. 2] I simply did my good duty to both report a bug to the vendor, and even provide a patch to help fix the issue. At anytime the Piwigo team could have set the visibility of this bug to private. (Or even had a dedicated security contact, with a PGP key etc.) But, as you can see from the [history of closed Piwigo issues on Github](https://github.com/Piwigo/Piwigo/issues?q=is%3Aissue+is%3Aclosed+label%3A%22Section%3A+Security%22) that reporting security issues via the Piwigo bug tracker seems to be the norm. If anyone else has any opinions or questions please keep them out of bug reports and feel free to contact me or Piwigo on Twitter instead. Thanks. <!-- github-comment-id:531190556 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#938