Piwigo EUVD-2026-87139

Requires an authenticated Piwigo administrator (the fix enforces webmaster status via is_webmaster()) who can reach the admin logo-upload feature in admin/themes_standard_pages.php (the std_pgs_logo upload). Exploitation additionally depends on the deployment's web server being configured to execute the attacker-chosen final extension (e.g. PHP handler active) for files served from the web-accessible logo directory. Limiting factors: high-privilege authentication is mandatory (no unauthenticated path), the logo upload feature must be used, and the target extension must be server-executable in that environment; installations that block script execution in upload directories are protected. Affected versions are all releases prior to 16.4.0.

This is a genuine remote code execution flaw (CWE-434 unrestricted upload of file with dangerous type), not a severity-inflated issue: the fix commit confirms the root cause - admin/themes_standard_pages.php validated logo uploads by MIME type but rebuilt the stored filename from the attacker-controlled extension, letting a PHP (or other server-executable) file land in the web-accessible logo directory and run on request. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) is largely defensible: network vector, low complexity, no user interaction, and full C/I/A loss via arbitrary command execution. The single most important limiter is PR:H - exploitation requires an authenticated administrator (the fix additionally enforces is_webmaster()), which sharply reduces the realistic attacker population and makes this closer to a privileged-insider or post-compromise escalation than a mass-exploitable pre-auth bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation; risk is targeted rather than widespread. The S:C (scope change) is defensible because uploaded code executes in the web server context beyond the application's security scope, though S:U (yielding ~8.8) would be a reasonable alternative. Net: high technical impact, but the admin-privilege prerequisite and niche footprint keep real-world priority moderate outside of directly-exposed Piwigo installs.

An attacker who already holds (or has phished/stolen) Piwigo administrator/webmaster credentials uploads a file whose content passes the image MIME check but whose filename carries a server-executable extension (e.g. .php); the file is stored in the web-accessible logo directory under the attacker-chosen extension. The attacker then requests that URL directly, and if the web server maps the extension to a handler, the payload executes as arbitrary code on the server. No public exploit code was identified at time of analysis, but the vulnerable code path and fix are fully documented in the vendor advisory and commits.