Piwigo EUVD-2026-87094

Requires (1) Piwigo configured to use the Imagick/ImageMagick library for image processing rather than the GD backend; (2) an authenticated account with image-upload permission (vendor rates PR:H/admin, but upload rights may be broader); and (3) for the arbitrary file read, only that Imagick renders SVG delegates on the crafted upload. Escalation to file write / RCE additionally requires a permissive ImageMagick policy.xml that allows MSL and SVG/coder delegates - often restricted or disabled in hardened installs, which is the primary limiting factor. No user interaction beyond the attacker's own upload is needed (UI:N).

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2) frames this as an authenticated, network-reachable flaw with full C/I/A impact. That impact profile is only partly reliable: the description confirms arbitrary file read via SVG/PNG format confusion (solidly C:H), but the file-write and remote-code-execution outcomes are explicitly qualified as occurring 'depending on configuration' and via ImageMagick's Magick Scripting Language (MSL) - a delegate path that modern ImageMagick installs frequently disable through policy.xml. So the I:H/A:H (and the RCE tag) represent a plausible worst case, not a guaranteed default outcome, and I:L/A:L is the more honest baseline for a default deployment. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so exploitation is theoretical/analytical at this stage. Two signals warrant verification: (1) the vendor rates PR:H (implying admin), but image upload in Piwigo is often available to lower-privileged authenticated users, so real privilege requirement may be PR:L; (2) the whole attack is gated on Piwigo using the Imagick library (not the GD backend) - a configuration-dependent prerequisite that materially narrows the exposed population. Net: a genuine authenticated flaw worth patching, but not an unauthenticated internet-mass-exploitation priority.

An authenticated Piwigo user with image-upload rights, on an instance configured to use the Imagick library, uploads a file that disguises SVG content as a PNG; when Imagick processes it, embedded SVG elements referencing local files cause server-side file disclosure (e.g., configuration or credential files). In an instance whose ImageMagick delegate/MSL policy is permissive, the attacker escalates to attacker-controlled MSL instructions to write files and achieve remote code execution. No public exploit code is referenced at time of analysis.