CVE-2026-85750

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0

Description Insufficient validation and unsafe processing of user-supplied image files when using the Imagick library allow for arbitrary file read and remote code execution. Attackers can use format confusion, such as disguising SVG content as PNG, to trigger the interpretation of embedded SVG elements that reference local files. Additionally, support for Magick Scripting Language (MSL)—a scripting language used to automate ImageMagick tasks—may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution depending on the configuration.

Recommendations Update to version 16.4.0.