A critical vulnerability in Piwigo allows an authenticated administrator to execute arbitrary code on the server by uploading a malicious file through the themes configuration interface.

The vulnerability is an unrestricted file upload flaw (CWE-434) located in the admin/themes_standard_pages.php script. An authenticated administrator can bypass MIME type validation by manipulating the file extension parameter, resulting in the storage and execution of server-side scripts.

The ability to achieve arbitrary code execution poses a severe risk to the entire hosting environment, potentially leading to a full system compromise. Given the CVSS score of 9.1, this flaw allows for unauthorized data access, modification, and potential lateral movement within the network. Such an incident could result in significant reputational damage and prolonged service disruption.

Immediate Action: Update the Piwigo application to version 16.4.0 or later immediately to resolve the vulnerable file handling logic.

Proactive Monitoring: Review web server access logs for requests to files within the logo directory that exhibit unexpected extensions or unusual access patterns.

Compensating Controls: Implement strict file system permissions to prevent the web server process from executing files in directories where user-uploaded content is stored.

Public Exploit Available: No (exploit_available: unknown)

Organizations running Piwigo must prioritize the upgrade to version 16.4.0 to neutralize this critical threat. Because administrative accounts are prime targets for attackers, securing the administrative interface and applying this update is essential to maintaining the integrity and availability of your photo gallery infrastructure.