CVE-2026-42322

Executive Summary

CVE-2026-42322 is an unrestricted file upload vulnerability (CWE-434) in Piwigo, an open-source photo gallery application, affecting versions prior to 16.4.0. The flaw resides in the administrator-facing theme logo upload functionality (admin/themes_standard_pages.php), where uploaded logo content is validated by MIME type but the stored filename reuses an attacker-controlled extension derived from the std_pgs_logo parameter. An authenticated administrator who uploads image content with a server-executable final extension (for example .php on a typical LAMP stack) can cause the file to be written into a web-accessible logo directory and executed when requested, enabling arbitrary command execution. Piwigo is commonly deployed on internet-facing web servers, so successful exploitation yields remote code execution with the privileges of the web server user, and Piwigo's administrative role makes the impact severe for installations where an admin account is compromised, reused, or shared.

Technical Analysis

The vulnerability is a classic file-upload / extension-confusion defect mapped to CWE-434 (Unrestricted Upload of File with Dangerous Type). Per the NVD description, the vulnerable code path is admin/themes_standard_pages.php, which handles uploading a theme "standard pages" logo. Two distinct validation and storage decisions occur in this flow:

1. Content validation by MIME type. The uploaded file's content is validated against expected image MIME types. This check inspects the declared/observed media type rather than the filename extension, and it can be satisfied by serving valid image content (e.g., a genuine GIF/JPEG/PNG payload).

2. Filename construction using an attacker-controlled extension. When constructing the stored filename, the application reuses the extension from the attacker-controlled std_pgs_logo value rather than deriving it from the validated MIME type or from an allow-list. Because content validation and extension selection are decoupled, an attacker can present content that passes the MIME check while the final stored filename carries a dangerous extension.

The resulting file is placed in the web-accessible logo directory. If the underlying web server is configured to interpret that extension as an executable script (most commonly .php via the PHP handler, but potentially other handler extensions such as .phtml, .php5, or server-specific types), a subsequent HTTP request for the uploaded file triggers server-side execution in the context of the web server process.

The extension is described as "final," meaning it is the trailing element of the generated filename. This is significant: a naive control that only checks the first extension or relies on a substring match (e.g., allowing logo.png.php) can be bypassed by ensuring the final extension is executable while an allowed image extension appears earlier in the name. The NVD description does not enumerate the exact filename template or the set of dangerous extensions accepted, so no specific token order or delimiter should be assumed beyond the stated fact that the reused extension is "final."

Preconditions. The CVSS vector (PR:H) confirms the attacker must already hold high privileges — specifically an authenticated administrator account. This is not a pre-auth vulnerability. However, Piwigo admin panels have historically been exposed on the public internet, and administrator credentials may be weak, reused, phished, or obtained through separate compromise. Once admin access exists, the upload check is the only remaining barrier, and it is defeated by the MIME/extension mismatch.

Root cause summary. The defect is a trust-boundary failure: an untrusted, attacker-supplied value (std_pgs_logo) is used verbatim to build a filesystem path/filename after a validation step (MIME check) that does not constrain that value's dangerous property (the extension). The S:C scope change in the CVSS vector reflects that the impact crosses from the Piwigo application context into the underlying host/web-server security context once code executes.

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE, and no CVSS vector or EPSS value beyond the NVD-recorded score should be assumed.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level, consistent with the NVD description. No public PoC exists; the sequence below is inferred from the file-upload / extension-confusion class and the specific details disclosed (MIME validation, std_pgs_logo, web-accessible logo directory, final extension execution).

1) Reconnaissance / target identification. An adversary identifies internet-facing Piwigo installations, e.g. by fingerprinting the gallery application (distinctive HTML, pwg identifiers, generator tags) via search engines or Shodan (http.html:"piwigo", http.title:"Piwigo"). Version identification narrows targets to releases below 16.4.0. Because exploitation requires an administrator session, the adversary either (a) already possesses/has harvested admin credentials, or (b) performs a preliminary credential attack against the Piwigo login before proceeding.

2) Triggering the specific flaw class. With an authenticated admin session, the attacker navigates to the administrative theme "standard pages" configuration — the functionality implemented in admin/themes_standard_pages.php. Through the logo upload, the attacker supplies file content that satisfies the application's image MIME-type validation (for example, a valid image payload), while arranging for the value tied to std_pgs_logo to carry a server-executable final extension. The application writes the file into the web-accessible logo directory using the attacker-controlled extension.

3) Payload / execution method. Because the stored file is web-accessible and retains a dangerous final extension, the attacker requests the file over HTTP. If the web server maps that extension to an interpreter (classic LAMP/.php deployments being the primary concern), the request executes the embedded server-side code rather than returning it as static image data. No specific function names, parameters, or code snippets beyond those disclosed are assumed here; the mechanism is extension-driven execution of attacker-controlled content.

4) Post-exploitation impact. Successful execution yields arbitrary command execution under the web server's privilege context. Per the NVD description, outcomes include arbitrary command execution, data disclosure, modification, persistence, and service disruption. In practice, an attacker could establish a persistent web shell (aligning with ATT&CK T1505 — Server Software Component), read or exfiltrate gallery/database data, alter content, pivot to other services reachable from the host, and degrade or disrupt availability.

Impact Assessment

The NVD-recorded CVSS is 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:

• AV:N (Network) — the upload and subsequent execution are reachable remotely over the network; no adjacent/local requirement.
• AC:L (Low) — the NVD description implies no complex preconditions beyond a valid admin session and image content that passes the MIME check; no race or special conditions are described.
• PR:H (High) — the attacker must be an authenticated administrator; this materially limits the unauthenticated blast radius but does not reduce severity once such access is obtained.
• UI:N (None) — no victim interaction is required beyond the attacker's own administrative actions.
• S:C (Changed) — impact crosses a security boundary: the Piwigo application constrains uploads, but the resulting stored file — once executed — operates in the web server/host context.
• C:H / I:H / A:H — high confidentiality, integrity, and availability impact; consistent with arbitrary command execution, data disclosure, modification, persistence, and service disruption stated in the description.

Business impact. Piwigo galleries are frequently self-hosted by SMBs, media organizations, educational institutions, and community groups on internet-reachable servers. Because the outcome is potential remote code execution, the consequences extend well beyond the gallery application itself: host compromise, lateral movement, brand and compliance damage, and data-protection exposure for hosted content and associated user data.

Blast radius. The exploited component is the Piwigo web application and the web server process hosting it; via that foothold the attacker can reach anything accessible to that process (local files, databases, network-reachable services). The PR:H requirement means the effective blast radius is gated by the availability of an administrator credential — the primary limiting factor.

Known exploitation status. No public PoC, no Nuclei template, no exploit code, and no CISA KEV entry are recorded for this CVE. EPSS has not yet been scored by FIRST.org; no EPSS value should be assumed. Severity is assessed as high because of the RCE outcome and the common internet exposure of Piwigo, not because of observed in-the-wild exploitation.

Detection Guidance

The detection rules below target the class-specific behavior: (a) use of the admin/themes_standard_pages.php endpoint and related logo-upload requests, and (b) subsequent requests to executable files placed under the Piwigo logo directory. Because no PoC exists, rules are necessarily heuristic and should be tuned to each environment's legitimate upload patterns.

Sigma Rule

title: Piwigo Theme Logo Upload with Executable Extension (CVE-2026-42322)
id: 8f1c2b74-9a3d-4e6f-b2c1-7d5e0a9f4c22
status: experimental
description: Detects POST requests to the Piwigo theme standard-pages admin endpoint
  carrying a logo filename with a server-executable extension, consistent with
  CVE-2026-42322 (extension confusion in theme logo upload).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-42322
author: Valters IT Threat Intelligence
date: 2026/05/12
tags:
  - attack.t1505
  - attack.t1190
  - cve.2026.42322
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|endswith: '/admin/themes_standard_pages.php'
  selection_exec_ext:
    cs-uri-query|contains:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.phar'
  selection_param:
    cs-uri-query|contains: 'std_pgs_logo'
  condition: selection_endpoint and (selection_exec_ext or selection_param)
falsepositives:
  - Legitimate administrators uploading standard image logos (no executable extension)
level: high

YARA Rule

rule CVE_2026_42322_Piwigo_Logo_Upload
{
    meta:
        author      = "Valters IT Threat Intelligence"
        description = "Detects uploaded Piwigo logo files carrying an executable extension and/or embedded script tags, consistent with CVE-2026-42322 extension confusion"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-42322"
        cve         = "CVE-2026-42322"
        date        = "2026-05-12"

    strings:
        $php_open   = "<?php" ascii nocase
        $php_short  = "<?" ascii
        $std_logo   = "std_pgs_logo" ascii wide
        $eval       = "eval(" ascii
        $system     = "system(" ascii
        $passthru   = "passthru(" ascii
        $shell_exec = "shell_exec(" ascii
        $base64dec  = "base64_decode(" ascii
        $img_magic_gif = { 47 49 46 38 }
        $img_magic_png = { 89 50 4E 47 0D 0A 1A 0A }
        $img_magic_jpg = { FF D8 FF }

    condition:
        uint32(0) != 0x04034b50 and
        (
            (
                ($php_open or $php_short) and
                any of ($eval, $system, $passthru, $shell_exec, $base64dec)
            ) or
            (
                $std_logo and
                any of ($php_open, $php_short)
            )
        ) and
        not all of ($img_magic_gif, $img_magic_png, $img_magic_jpg)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-42322 Piwigo theme logo upload with executable extension"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin/themes_standard_pages.php"; http.uri; content:"std_pgs_logo"; http.request_body; content:"filename="; nocase; pcre:"/filename=[^&;\r\n]*\\.(php|phtml|php5|php7|phar)[\"'\s;]/i"; classtype:web-application-attack; reference:cve,2026-42322; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-42322; sid:2026423220; rev:1;)

alert http any any -> any any (msg:"CVE-2026-42322 Piwigo possible webshell access under logo directory"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/logo/"; nocase; http.uri; pcre:"/\\.(php|phtml|php5|php7|phar)(\\?|$)/i"; classtype:web-application-attack; reference:cve,2026-42322; sid:2026423221; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST"
      and url.path endswith "/admin/themes_standard_pages.php"
      and url.query contains "std_pgs_logo"
      and http.request.body.content regex ".*filename=.*\\.(php|phtml|php5|php7|phar).*" ]
  [ network where http.request.method == "GET"
      and url.path regex ".*/logo/.*\\.(php|phtml|php5|php7|phar).*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=coalesce(uri, cs_uri_stem, url)
| eval qs=coalesce(uri_query, cs_uri_query, "")
| where (match(uri, "(?i)/admin/themes_standard_pages\\.php$") AND (match(qs,"(?i)std_pgs_logo") OR match(qs,"(?i)\\.(php|phtml|php5|php7|phar)")))
    OR (match(uri, "(?i)/logo/") AND match(uri, "(?i)\\.(php|phtml|php5|php7|phar)"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(qs) as queries by src_ip, status
| convert ctime(first_seen) ctime(last_seen)
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,piwigo,cve-2026-42322,">
  <rule id="2026422" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>/admin/themes_standard_pages\.php</match>
    <regex>std_pgs_logo</regex>
    <description>CVE-2026-42322: Piwigo theme logo upload referencing std_pgs_logo - possible malicious file upload</description>
    <mitre>
      <id>T1190</id>
      <id>T1505</id>
    </mitre>
    <group>attack,file_upload,</group>
  </rule>

  <rule id="2026423" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>/logo/</match>
    <regex>\.(php|phtml|php5|php7|phar)(\?|$)</regex>
    <description>CVE-2026-42322: Access to executable file in Piwigo logo directory - possible webshell execution</description>
    <mitre>
      <id>T1505</id>
    </mitre>
    <group>attack,webshell,</group>
  </rule>

  <rule id="2026424" level="10">
    <if_sid>2026422</if_sid>
    <match>POST</match>
    <description>CVE-2026-42322: POST to Piwigo themes_standard_pages.php correlated with upload activity</description>
    <group>attack,file_upload,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the vulnerability is fixed in Piwigo 16.4.0; however, no patch artifact was available from any tracked source at the time of writing, and no CVE-linked vendor advisory, workaround, or affected-version list was provided. The guidance below therefore combines the stated fixed version with defense-in-depth controls.

1) Immediate mitigations (until upgrade can be completed):

• Restrict and monitor administrator access: enforce strong, unique credentials, enable MFA if supported by the deployment, and audit all admin accounts. Because the vulnerability requires PR:H, protecting admin sessions is the single most effective control.
• Constrain the affected endpoint: if the theme standard-pages logo functionality is not required, block or disable access to admin/themes_standard_pages.php at the reverse proxy/WAF for untrusted sources, or remove the feature where operationally feasible.
• Harden the web server against execution in the logo directory: disable script/handler execution in the web-accessible logo directory (e.g., via server configuration that prevents PHP and other interpreters from processing files under that path). This directly neutralizes the "executed when requested" condition described in the CVE.
• Add WAF rules to reject uploads whose final extension is a server-executable type when submitted to the affected endpoint, and alert on requests for executable files under logo/.
• Enforce strict file-type allow-listing at the proxy layer (permit only expected image extensions and impose content-type + magic-byte checks) as a compensating control.

2) Patch / upgrade steps:

• Upgrade Piwigo to 16.4.0 or later, which per the NVD description fixes the flaw. Verify the installed version before and after upgrading.
• Because no patch artifact was available from any tracked source, validate the fix in a staging environment and confirm the official Piwigo release/advisory before production rollout. Apply the upgrade during a maintenance window given the application is admin-critical.
• After upgrading, review the logo directory and any recently uploaded theme assets for unexpected or executable files, and remove anything suspicious.

3) Long-term hardening:

• Store user-uploaded content outside the web root wherever possible, and serve it via a non-executing delivery path.
• Decouple file content validation from filename construction: derive stored extensions from a server-side allow-list, never from client-supplied values, and validate both content (magic bytes) and extension consistently.
• Apply a hardened web-server configuration baseline: no script execution in upload directories, least-privilege web server user, restricted outbound egress, and filesystem write restrictions.
• Maintain an asset/version inventory for internet-facing Piwigo instances, subscribe to Piwigo security announcements, and regularly review admin accounts and access logs for anomalous upload or logo/ access patterns.
• Because no EPSS score, no KEV listing, and no PoC currently exist, prioritize patching based on the RCE outcome and exposure rather than observed exploitation — but do not defer hardening given the critical CVSS of 9.1.

References

• NVD — CVE-2026-42322: https://nvd.nist.gov/vuln/detail/CVE-2026-42322
• MITRE CWE-434 — Unrestricted Upload of File with Dangerous Type: https://cwe.mitre.org/data/definitions/434.html
• MITRE ATT&CK T1505 — Server Software Component (Web Shell): https://attack.mitre.org/techniques/T1505/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Piwigo project / release notes (verify fixed version 16.4.0): https://piwigo.org/

Threat actor / exploit status. No known threat actor campaigns and no exploit-in-the-wild evidence are associated with CVE-2026-42322 in the data provided. There is no CISA KEV entry, no public PoC, no exploit code, and no Nuclei template. EPSS has not yet been scored by FIRST.org; no EPSS value is reported here.