CVE-2026-78187

Executive Summary

CVE-2026-78187 is a reflected cross-site scripting (XSS) vulnerability in Piwigo 16.3.0, specifically in the Public Authentication Page component, triggered via the lang argument. An unauthenticated, remote attacker can craft a malicious link that, when clicked by an authenticated or targeted user, executes arbitrary JavaScript in the context of the victim's Piwigo session. The attack has a high attack complexity, requiring user interaction (UI:R), and results in low integrity impact without confidentiality or availability loss. The vulnerability is publicly disclosed, yet patch evidence from the tracking source is scored 0/4, indicating the fix is not yet verifiable across all distribution channels; an upstream commit (5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e) and version 16.4.0 are referenced as the fix. Enterprise deployments running Piwigo 16.3.0 with unauthenticated access to the authentication page are at risk of account manipulation, session hijacking, and content defacement.

Technical Analysis

The vulnerability exists within the authentication page (Public Authentication Page) of Piwigo 16.3.0. According to the NVD description, an unknown function in this component processes the lang argument without proper sanitization, allowing an attacker to inject arbitrary HTML and JavaScript. The root cause is the lack of output encoding or input validation on the lang parameter, which is likely reflected in an HTML context during page rendering (e.g., inside a <script> tag, an attribute value, or a variable assignment for the language selection).

Attack surface: The component is part of the authentication page, which by default is accessible remotely over HTTP/HTTPS. Because authentication does not precede the page load, the endpoint is reachable by unauthenticated users, broadening the exposure. However, the high attack complexity introduces some constraint—the attacker must carefully craft a payload that bypasses browser-level XSS filters, potential CSP policies, and the specific parsing logic of the lang argument. Additionally, user interaction is required because the victim must click or navigate to a crafted URL.

Attack mechanism at the code level (inferred from class, not specific implementation): In typical PHP MVC frameworks like Piwigo, a parameter such as lang would be retrieved from the $_GET or $_POST superglobal and eventually emitted to the response HTML without a htmlspecialchars() or equivalent encoding call. In this case, the lang parameter is likely embedded in a language-selection dropdown or a hidden input field. If the parameter is merely concatenated into the page markup, a payload like lang="><script>alert(document.cookie)</script> would terminate the existing attribute and inject a new script element.

Patch analysis: The referenced patch commit (5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e) is upstream, and version 16.4.0 is designated as the fix release. The fact that the patch name is given but the patch confidence is 0/4 implies the tracking system does not have observable proof that the commit was universally applied, packaged, or distributed. This could be due to a delay between the release of version 16.4.0 and its availability in all distribution channels (e.g., PHPComP, apt, manual ZIP), or because the public-facing fix is unverified. It is not yet confirmed whether the fix applies output encoding, input filtering, or both. We recommend treating the system as potentially vulnerable until version 16.4.0 is confirmed running and the source code is inspected.

Exploitation Scenarios

The attack chain for CVE-2026-78187 follows the typical vector for a reflected XSS in a user-facing web application.

1. Reconnaissance/identification: The attacker identifies a target running Piwigo 16.3.0, either through Shodan searches (http.html:"Piwigo"), fingerprinting via the X-Piwigo header, or by observing the application's standard login page. The attacker confirms the version via the pwg_install or version metadata in the HTML, or by inspecting the lang parameter behavior.

2. Crafting the exploit link: The attacker constructs a malicious URL that includes an XSS payload in the lang parameter. Because the parameter is reflected in the page, the attacker does not need a separate delivery mechanism beyond phishing or social engineering. The URL might resemble: https://target.piwigo.example/user.php?lang=%22%3E%3Cscript%3Ealert(1)%3C/script%3E Note: These specific endpoint paths are only examples to illustrate the mechanism—we do not have confirmed path names from the disclosure.

3. Triggering the flaw: The attacker sends the link to a victim (via email, chat, or a compromised site). The victim must click it while authenticated or while having an active Piwigo session. If the victim's browser renders the reflected payload, the malicious JavaScript executes.

4. Post-exploitation impact: With JavaScript running in the victim's session, the attacker can:

   • Steal session cookies and hijack the victim's admin or contributor session.
   • Perform unauthorized actions on behalf of the victim (e.g., changing gallery settings, deleting photos, altering user permissions).
   • Deface the authentication page or inject persistent forms to harvest credentials of other users who subsequently visit the page.

The CVSS score of 3.1 reflects the difficulty of exploitation and the limited scope (no confidentiality loss, no availability impact). However, the business impact is amplified if the XSS is used to pivot into a higher-privilege account or if the gallery is publicly accessible and used as a phishing lure.

Impact Assessment

The primary impact is integrity: an attacker can modify the content or behavior of the Piwigo authentication page in the victim's browser, potentially leading to session hijacking and account manipulation. The confidentiality impact is rated as none within the CVSS vector because the XSS does not directly leak data; however, stolen session cookies indirectly expose gallery data and user credentials.

Business impact depends on the role of the Piwigo instance:

• For a corporate photo/shared-asset gallery: an attacker could gain admin access, exfiltrate proprietary images, or deploy ransomware-style defacement.
• For a public community gallery: attacker could perform account takeover of moderators, leading to content poisoning or malware distribution via uploaded images.
• Because the attack requires user interaction and has high complexity, the likelihood of mass exploitation is low, but targeted phishing against gallery administrators is plausible.

The blast radius is limited to the specific application instance, as XSS does not grant access to the underlying server. However, if the web server shares a session or cookie domain with other applications, session theft may propagate across the site. The compromise of an admin account elevates the risk to full data integrity of the gallery, which could be considered critical for an organization that relies on Piwigo for archival or compliance-related imagery.

Detection Guidance

Sigma Rule

title: Piwigo Public Auth Page lang Parameter XSS Attempt
id: 5c9f2d6a-8f8e-4c03-b1e1-2f0a3b0c4d5e
status: experimental
description: Detects attempts to exploit CVE-2026-78187 by sending XSS payloads in the lang parameter of Piwigo's authentication page.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-78187
author: Valtersit CTI Team
logsource:
    category: webserver
    product: apache
    definition: 'Requires access logs of web server or reverse proxy in front of Piwigo'
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - 'lang='
            - '%3Cscript%3E'
            - '%3Cimg%20'
            - '%3Csvg%20'
            - 'onerror='
            - 'javascript:'
    condition: selection and cs-uri-query|contains: 'piwigo'
level: medium
falsepositives:
    - Users with legitimate language codes containing special characters (unlikely)
fields:
    - src_ip
    - cs-uri-query
    - user-agent

YARA Rule

rule Piwigo_Reflected_XSS_lang_Parameter {
    meta:
        author = "Valtersit CTI Team"
        description = "Detects XSS payload patterns in Piwigo auth page requests"
        reference = "CVE-2026-78187"
        date = "2026-01-01"
    strings:
        $payload1 = "lang=" nocase
        $payload2 = "<script>" nocase
        $payload3 = "onerror=" nocase
        $payload4 = "javascript:" nocase
        $encoded_payload = /%3C(script|img|svg)%3E/i
    condition:
        any of them and (filesize < 10KB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS Piwigo Public Auth Page XSS Attempt (CVE-2026-78187)"; flow:to_server,established; content:"GET"; http_method; content:"lang="; http_uri; content:"<script>"; http_uri; content:"!"; http_uri; sid:202678187; rev:1; classtype:web-application-attack; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78187; metadata:created_at 2026_01_01, updated_at 2026_01_01)

Elastic Detection

sequence by source.ip
  [network where network.protocol == "http" and http.request.method == "GET" and 
   url.path in ("/", "/index.php", "/pwg.php") and url.query contains "lang=" and
   (url.query contains "<script>" or url.query contains "%3Cscript%3E" or url.query contains "onerror")]
  [process where process.name == "httpd" and event.action in ("request", "response")]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*/index.php" OR uri_path="*/user.php" uri_query="*lang=*"
| rex field=uri_query "lang=(?<lang_param>[^&]+)"
| where match(lang_param, "(?i)(<script|%3Cscript|onerror|javascript:)")
| table _time, src_ip, uri, lang_param, user, status
| sort -_time

Wazuh OSSEC Rule

<group name="web, xss, piwigo,">
  <rule id="100203" level="8">
    <decoded_as>web</decoded_as>
    <match>GET /user.php</match>
    <regex>lang=.*(?:%3Cscript%3E|&lt;script&gt;|onerror=|javascript:)</regex>
    <description>CVE-2026-78187 - Piwigo Public Auth Page XSS Payload in lang parameter</description>
    <group>attack,xss,web_application,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — this is classified as UNPATCHED with no confirmed patch evidence from the tracking source. The upstream fix commit 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e and release version 16.4.0 are referenced, but their availability and correctness in the common distribution channels are not yet fully verified. Treat all instances running 16.3.0 as potentially exploitable.

Immediate mitigations:

• WAF rule: Deploy a virtual patch via ModSecurity (OWASP CRS rule 941100 or custom rule) to block requests containing XSS payload patterns in the lang parameter.
• Disable unauthenticated access: If possible, restrict network access to the authentication page to trusted IP ranges via firewall or reverse proxy ACLs, reducing the attack surface for external actors.
• Session hardening: Enable HttpOnly, Secure, and SameSite=Strict flags on all Piwigo session cookies to limit the impact of successful XSS—JS cannot read HttpOnly cookies, and SameSite=Strict blocks cross-site requests.
• Short-term monitoring: Actively monitor web access logs for any requests where the lang parameter contains script tags or known XSS patterns (see detection rules above).

Patch/upgrade steps:

• Upgrade to Piwigo 16.4.0 immediately after verifying its integrity (SHA-256 checksum) from the official Piwigo releases page. If the version is not yet available in your package manager, use the manual download from piwigo.org.
• After upgrading, verify the patch: check the lang parameter is no longer reflected unencoded. This can be tested by sending a request like /?lang=test%22%3Etest and confirming the response does not replicate the raw string in an HTML context.
• If your deployment is custom-modified, reapply any local patches on top of the new version.

Long-term hardening:

• Enforce a Content Security Policy (CSP) with script-src 'self' (and appropriate nonce or hashes) to prevent inline script execution, acting as a second line of defense for any future XSS issues.
• Regularly update Piwigo and its dependencies (PHP, MySQL) to mitigate chained attacks.
• Conduct periodic source-level code reviews of the authentication module for output encoding issues, or integrate Web Application Firewall signatures as part of a broader DevSecOps pipeline.
• Follow the Piwigo security mailing list or GitHub advisories for future disclosures to catch alerting vulnerabilities before public exploitation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-78187
2. Piwigo Official Site / Release Notes for 16.4.0: https://piwigo.org/forum/index.php (referenced upstream commit)
3. HackerOne / Researcher Disclosure (if publicly available): https://hackerone.com/reports/ (search for CVE-2026-78187)
4. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/
5. OWASP XSS Prevention Cheat Sheet (mitigation reference): https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Threat actor campaigns: As of the writing of this report, there is no evidence from the data provided that this CVE has been exploited in the wild or included in CISA KEV. No mass-campaign activity has been observed. However, the public disclosure of the exploit mechanism increases the likelihood of future targeting by opportunistic attackers scanning for Piwigo instances.