---
id: CVE-2026-85750
title: >-
  Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code
  execution in image upload handling when using the Imagick library due to
  insufficient validation and unsafe processing of user-supplied image files
summary: >-
  Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code
  execution in image upload handling when using the Imagick library due to
  insufficient validation and unsafe processing of user-supplied image files. By
  abusing fo…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-20
vendor: Piwigo
product: Piwigo
affected:
  - Piwigo <= 16.3.0
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:17:56.560'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85750'
references:
  - url: 'https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw'
    label: security-advisories@github.com
  - url: 'https://www.helx.io/en/blog/advisory-piwigo'
    label: security-advisories@github.com
  - url: 'https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-25T14:38:16.238956Z'
ingestedAt: '2026-09-25T14:09:46.370Z'
---

## Overview

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.