CVE-2016-10105: Piwigo

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.

Affected products

• Piwigo Piwigo: up to and including 2.8.3

Published 2017-01-03. Last modified 2026-06-17.