Arbitrary file read and RCE in Piwigo

Introduction

Piwigo is an open-source web application for managing and sharing photos. It is used by individuals, associations and organizations to host galleries, manage albums and control access to media.

Issue

We identified a high-risk vulnerability in Piwigo affecting versions up to and including 16.3.0. Uploaded files are not validated thoroughly enough when images are processed by the Imagick library: a file whose actual content does not match its declared extension is still interpreted by ImageMagick.

A user with administrative privileges can therefore read arbitrary files from the server and, depending on the ImageMagick configuration, write files and achieve remote code execution.

Timeline

Technical details

Format confusion

ImageMagick does not trust a file's extension: it determines which format to process from the content itself. If the application does not check that the uploaded file really is an image of the expected type, an attacker can submit an SVG document under a .png name. Imagick then parses it as SVG, with everything that format allows: references to external or local resources, and calls to other ImageMagick coders.

Arbitrary file read

The following file, named for instance image.png, actually contains an SVG. Its image element references the local file /etc/passwd through ImageMagick's text: pseudo-protocol, which renders the content of a text file as an image.

<svg width="1000" height="1000" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
  <image xlink:href="text:/etc/passwd" width="1000" height="1000" />
</svg>

Once this file is uploaded, the thumbnail or resized version generated by Piwigo displays the content of /etc/passwd. Any file readable by the web server user can be exfiltrated the same way: configuration files, database credentials, keys.

Towards code execution

ImageMagick also supports the Magick Scripting Language (MSL), an XML format describing a sequence of operations: reading a resource, transforming it, then writing the result to disk. When the MSL coder is reachable, a malicious SVG can invoke it and write a file to a location chosen by the attacker. If that location is served and interpreted by the web server, for instance a PHP file inside the Piwigo tree, the file write turns into remote code execution.

Whether this second step is feasible depends on the ImageMagick version and its security policy (policy.xml).

Impact

• Reading local files from the server
• Writing files on the server
• Remote code execution, depending on the ImageMagick configuration

Remediation

The vulnerability is fixed in Piwigo 16.4.0. We recommend upgrading every instance to this version or later.

In addition, and for instances that cannot be upgraded right away, we recommend:

• strictly validating the type of uploaded files, based on the actual MIME type and magic bytes rather than the extension;
• sanitizing accepted SVG files to strip dangerous elements and resource references;
• hardening the ImageMagick security policy (policy.xml) to disable dangerous coders, in particular SVG, MSL and TEXT.

<policymap>
  <policy domain="coder" rights="none" pattern="{SVG,MSVG,MSL,TEXT,URL,HTTP,HTTPS}" />
  <policy domain="path" rights="none" pattern="@*" />
</policymap>

Resources

• Advisory GHSA-j9q6-q52g-g8jw
• GitHub project
• CVE-2026-85750