CVE-2026-85750 Piwigo CVE debrief

Who should care

Piwigo administrators, security teams, and users who upload images to Piwigo installations should prioritize upgrading to version 16.4.0 or later and review image upload handling and Imagick library usage. This vulnerability has a high impact on confidentiality, integrity, and availability, and affected operators, platforms, vulnerability-management, and security teams should take immediate action to mitigate the vulnerability.

Why it matters

CVE-2026-85750 is a high-severity vulnerability in Piwigo that allows for arbitrary file read and remote code execution. Piwigo administrators and security teams should prioritize upgrading to version 16.4.0 or later and review image upload handling and Imagick library usage.

• Potential unauthorized server-side file reads and writes
• Possible remote code execution on affected Piwigo installations
• Need for verification of Piwigo version and Imagick library usage
• Potential impact on confidentiality, integrity, and availability

Technical summary

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration.

Defensive priority

High priority for Piwigo administrators and security teams

Recommended defensive actions

• Upgrade Piwigo to version 16.4.0 or later
• Review and restrict image upload handling and Imagick library usage
• Monitor for suspicious image upload activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Piwigo before v16.4.0, which allows for arbitrary file read and remote code execution in image upload handling when using the Imagick library.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.