A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

A path traversal vulnerability has been identified in Piwigo versions up to 16.3.0, affecting the i.php file within the Image Derivative Handler component. The flaw allows remote attackers to manipulate file paths, potentially accessing unauthorized files on the server. No authentication appears to be required to exploit the vulnerability, as indicated by the PoC title referencing 'unauthenticated' access. A public exploit has been disclosed on GitHub, increasing the risk of active exploitation. The vulnerability is remotely exploitable, making it a significant security concern for Piwigo installations. Users of Piwigo up to version 16.3.0 are advised to apply patches or mitigations promptly. The issue has been catalogued on NVD, VulDB, and supported by a proof-of-concept repository.